CVE-2026-65764 MEDIUM

CVE-2026-65764: Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.1.1

Vendor Phoca.cz
Product Phoca Commander extension for Joomla
Weakness CWE-79 · XSS
Published July 27, 2026
Last update July 27, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability.

Explanation of Vulnerability in Simple Terms

02Summary

Phoca Commander for Joomla contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application. An attacker can craft a malicious link or page that, when visited by a site administrator or user, executes arbitrary JavaScript in their browser. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.

What an attacker can do

03Attacker Capabilities

Inject and execute malicious JavaScript in a user's browser session.

Potential impact on your site

04Site Impact

Administrators and users visiting malicious links could have their sessions hijacked or credentials stolen.

Conditions required to exploit

05Prerequisites

A user must visit a malicious link or page crafted by the attacker while logged into the Joomla site.

Key dates

06Disclosure timeline

July 27, 2026 CVE published
July 27, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-65470 WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-65527 WordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-15100 Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute CVE-2026-65465 WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-15665 Fluent Support <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute