CVE-2026-65762 describes a reflected XSS vulnerability in the Phoca Guestbook extension for Joomla, affecting versions 5.0.0 to 6.1.0. The vulnerability arises from improper neutralization of user input during web page generation, enabling an attacker to inject malicious scripts that are reflected back to users. This can lead to limited impact such as user interface manipulation or theft of user session data under certain conditions. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction needed, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application for users who interact with crafted input. This may result in limited confidentiality and integrity impacts, such as theft of user credentials or session tokens, or manipulation of the user interface. However, the overall impact is rated medium due to the requirement for user interaction and limited scope of the vulnerability.

No official patch or remediation has been announced by the vendor as of now. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation or output encoding workarounds if feasible, and avoid exposing the vulnerable extension to untrusted users where possible.