CVE-2026-65763

MediumCVSS 5.1

Published: 23/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.44%

37th percentile - higher than 37% of all known CVEs

Summary

The Joomla extension Phoca Maps versions 5.0.0-6.0.4 contains a Reflected XSS vulnerability due to improper validation of user inputs.

Risk Assessment

An attacker can inject a malicious script that executes in the victim's browser, potentially stealing sessions or data.

Recommendation

Update Phoca Maps to version 6.0.5 or later, which includes input validation fixes.

Other vulnerabilities in Phoca Maps

CVE-2026-23900Medium
Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.

Original NVD description (English source)

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs lead to a reflective XSS vulnerability.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS