CVE-2026-23900

CVE-2026-23900: Extension - phoca.cz - Stored XSS vectors in Phoca Maps component 5.0.0 - 6.0.2 for Joomla

Vendor Phoca.cz

Product phoca.cz - Phoca Maps for Joomla

Weakness CWE-79 · XSS

Published April 11, 2026

Last update April 14, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.

Explanation of Vulnerability in Simple Terms

02Summary

Phoca Maps for Joomla versions 5.0.0 through 6.0.2 contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in the browsers of site visitors or administrators. The vulnerability's exact attack vector and required privileges are not yet documented. Site owners should update to a version newer than 6.0.2 when available.

What an attacker can do

03Attacker Capabilities

Inject malicious scripts that run in visitors' or admins' browsers to steal data or perform actions.

Potential impact on your site

04Site Impact

Visitors and administrators could have their sessions hijacked, credentials stolen, or be redirected to malicious sites.

Conditions required to exploit

05Prerequisites

Access to inject content into the vulnerable component; user interaction may be required.

Key dates

06Disclosure timeline

April 11, 2026 CVE published

April 14, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-23900 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities