CVE-2026-58148 is a high-severity stored XSS vulnerability in the ChronoForms extension for Joomla, affecting versions 8.0 to 8.0.52. The vulnerability permits unauthenticated attackers to inject malicious scripts that persist and execute when other users access the compromised content. This improper input neutralization during web page generation can lead to significant impacts on confidentiality, integrity, and availability of affected systems. The CVSS v4.0 base score is 8.7, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of affected users, potentially resulting in session hijacking, defacement, or redirection to malicious sites. Because the vulnerability is unauthenticated and stored, it poses a significant risk to all users interacting with the affected Joomla sites using the vulnerable ChronoForms extension versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, consider disabling or removing the ChronoForms extension if feasible, or applying input validation and output encoding controls at the application level to mitigate stored XSS risks.