TPVEnlanube EUVD-2026-88201

Requires an authenticated backend account (PR:L) able to reach the VirtueMart user-add endpoint '/administrator/index.php?page=admin.user_add&option=com_virtuemart' to store the payload in the 'Apellido 1' field. Execution additionally requires a privileged user or administrator to subsequently view the affected user record (UI:A/required), so it is not self-triggering. Limiting factors: two-actor dependency (attacker stores, victim views), authenticated access needed, and impact confined to script execution in the victim's browser session within the Joomla admin context - no direct server-side code execution.

This is a low-to-moderate real-world risk despite the XSS classification. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SI:L) yields only 4.8 and models a very narrow impact - solely a low integrity impact (SI:L) with no confidentiality or availability effect claimed. Key gating signals reduce urgency: exploitation requires an authenticated attacker (PR:L) to first store the payload, and requires a separate privileged user/admin to view the affected user record (UI:A/UI:R). There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so all exploitation-likelihood signals are either absent or negative. The vendor's own impact scoping (integrity-only, no confidentiality) arguably understates a stored XSS in an admin panel, where session/cookie theft or admin-action forgery is plausible - I lean toward C:L/I:L with a scope change. No conflicting attack-vector data (both description and CVSS agree on network vector plus authentication). Overall: a genuine but low-priority issue, not a high-CVSS-but-hollow finding nor an actively-exploited emergency.

An authenticated attacker with access to the com_virtuemart user administration submits a crafted value in the 'Apellido 1' (surname) field of the user-add form, storing a malicious script. When an administrator or other privileged user later opens that user record in the Joomla admin backend, the script executes in their browser, enabling session hijacking or admin-action forgery. No public proof-of-concept exploit has been identified.