CVE-2026-65762 MEDIUM

CVE-2026-65762: Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0

Vendor Phoca.cz
Product Phoca Guestbook extension for Joomla
Weakness CWE-79 · XSS
Published July 23, 2026
Last update July 24, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XSS vulnerability.

Explanation of Vulnerability in Simple Terms

02Summary

The Phoca Guestbook extension for Joomla contains a cross-site scripting (XSS) vulnerability in versions 5.0.0 through 6.1.0. An attacker can inject malicious scripts that execute in visitors' browsers when they view guestbook entries. The vulnerability requires user interaction—a victim must visit a page containing the malicious payload. Site administrators should update to a version newer than 6.1.0 when available.

What an attacker can do

03Attacker Capabilities

Inject JavaScript that runs in visitors' browsers and steals session cookies or credentials.

Potential impact on your site

04Site Impact

Visitors' accounts and data at risk if they view compromised guestbook entries; potential reputation damage.

Conditions required to exploit

05Prerequisites

Network access to the site; victim must view a guestbook entry containing the malicious script.

Key dates

06Disclosure timeline

July 23, 2026 CVE published
July 24, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-65764 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.1.1 CVE-2026-15464 WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute CVE-2026-15665 Fluent Support <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute CVE-2026-65528 WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability CVE-2026-15425 Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)