CVE-2026-58148 is an unauthenticated stored cross-site scripting (CWE-79) vulnerability in the ChronoForms extension for Joomla, versions 1.0 through 8.0.52. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject and store malicious scripts that execute in the context of users visiting the affected Joomla sites. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and user interaction required. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability could allow unauthenticated attackers to execute arbitrary scripts in the browsers of users who visit affected Joomla sites using the ChronoForms extension. This can lead to theft of user credentials, session hijacking, or other malicious actions performed with the privileges of the victim user. The vulnerability affects all users of the affected versions of the ChronoForms extension.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor for updates from the vendor. Until a patch is available, consider disabling or restricting access to the ChronoForms extension to reduce exposure. Avoid exposing the affected Joomla sites to untrusted users or inputs that could trigger the vulnerability.