Lack of output escaping leads to a XSS vector in the readmore links for com_content.CreditspeterhulstReferenceshttps://developer.joomla.org/security-centre/1036-20260504-core-xss-in-readmore-links