VirtueMart CVE-2025-55757

Exploitation requires the attacker to deliver a crafted URL to a user of a VirtueMart-powered Joomla store and have that victim click it (UI:R in the vector) - there is no server-side authentication requirement (PR:N), so any unauthenticated attacker can generate the malicious link, but there is no exploitation without victim interaction. The affected deployment is any Joomla site running VirtueMart versions 1.0.0 through 4.4.10. Because the flaw is reflected rather than stored, each target must be socially engineered individually, which substantially limits scale; impact is confined to the victim's browser session (confidentiality and integrity, low), with no availability effect.

This is a moderate-severity reflected XSS (CVSS 6.1, CWE-79) whose real-world priority is modest. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N confirms network reachability with low attack complexity and no privileges, but exploitation is gated on user interaction (UI:R) - the victim must click an attacker-crafted link, which is the primary factor limiting mass exploitation. The scope change (S:C) reflects that injected script executes in the victim's browser rather than the server's security context, and impact is limited (C:L/I:L, A:N). EPSS is low at 0.20% (9th percentile), consistent with reflected (rather than stored or wormable) XSS that requires per-victim social engineering. There is no CISA KEV listing and no confirmed public exploit, so this is best treated as a routine patch-management item rather than an emergency: a genuine but low-urgency issue, not a high-CVSS-but-overblown one - the 6.1 score already reflects the interaction requirement. No SSVC decision data was provided in the input, so automatable/technical-impact framing could not be cross-referenced. The CVSS vector and description are consistent (both support remote, unauthenticated, interaction-dependent exploitation), with no contradictions to flag.

An attacker crafts a URL to a VirtueMart-powered Joomla store containing a malicious script payload in a reflected parameter and lures a store user or administrator into clicking it (e.g., via phishing email or a link on another site). When the victim opens the link, the unsanitized input is reflected into the page and executes in their browser session, allowing cookie/session theft or actions performed as that user. No public exploit code was identified in the provided input, though the referenced GitHub CVE repository may contain reproduction details.