CVE-2026-102786 HIGH

CVE-2026-102786: Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5

Vendor Phoca.cz
Product Phoca Gallery extension for Joomla
Weakness CWE-79 · XSS
Published October 23, 2026
Last update October 25, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5

Key dates

02Disclosure timeline

October 23, 2026 CVE published
October 25, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-15798 Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute CVE-2026-78077 Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10 CVE-2026-66917 Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 CVE-2026-75964 User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter CVE-2026-28162 WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability