This vulnerability, identified as CVE-2026-23900, concerns stored cross-site scripting (CWE-79) in the Phoca Maps component for Joomla, specifically versions 5.0.0 to 6.0.2. The issue arises from insufficient input sanitization in the rendering logic for maps and icons, allowing attackers to inject malicious scripts that persist and execute in users' browsers. The CVSS v3.1 base score is 6.5, indicating a medium severity with network attack vector, low complexity, no privileges or user interaction required, and impacts on confidentiality and integrity. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to data disclosure or manipulation of displayed content. The impact is limited to confidentiality and integrity, with no availability impact reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying workarounds if available or restrict access to vulnerable components. Monitor official phoca.cz and Joomla security channels for updates.