In Joomla! before 3.7.4, inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-3224
https://developer.joomla.org/security-centre/701-20170605-core-xss-vulnerability.html