Vulnerability · Published Jun 4, 2025 · Assigned by Joomla

CVE-2025-27444Extension - rsjoomla.com - A reflected XSS vulnerability RSform!Pro component 3.0.0 - 3.3.13 for Joomla

Medium 4.8

In plain English

A medium-severity cross-site scripting in RSform!Pro component for Joomla from rsjoomla.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.3%top 75.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A reflected XSS vulnerability in RSform!Pro component 3.0.0 - 3.3.13 for Joomla was discovered. The issue arises from the improper handling of the filter[dateFrom] GET parameter, which is reflected unescaped in the administrative backend interface. This allows an authenticated attacker with admin or editor privileges to inject arbitrary JavaScript code by crafting a malicious URL.

Affected products (as reported)

Vendor	Product	Versions
rsjoomla.com	RSform!Pro component for Joomla	3.0.0-3.3.13

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

References

https://rsjoomla.com/ product