In Joomla! before 3.9.19, incorrect input validation of the module tag option in com_modules allows XSS.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-5980
https://developer.joomla.org/security-centre/815-20200603-core-xss-in-com-modules-tag-options