CVE-2026-23900 Extension - phoca.cz - Stored XSS vectors in Phoca Maps component 5.0.0 - 6.0.2 for Joomla
Stored XSS in Phoca Maps allows attackers to inject scripts into map and icon rendering, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-23900?
CVE-2026-23900 is a medium-severity cross-site scripting vulnerability in phoca.cz - Phoca Maps for Joomla, published on 11 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.
Weakness: CWE-79
Which versions are affected by CVE-2026-23900?
It affects 1 product.
Products include Phoca Maps.
How do I fix CVE-2026-23900?
No fix has been published for CVE-2026-23900 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-23900 being exploited?
There is no known exploitation of CVE-2026-23900 in the wild and no public exploit code.
Sources
Also known as GHSA-p4gj-pp28-43q4.