CVE-2026-23900

16th percentile - higher than 16% of all known CVEs

Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.

An attacker can inject malicious script that executes in a visitor's browser, potentially leading to session theft or other attacks.

Update Phoca Maps to a version newer than 6.0.2 (if available) or apply available workarounds. Regularly review code for XSS vulnerabilities.