The Phoca Maps extension for Joomla, versions 1.0.0 through 6.0.9, contains a reflected XSS vulnerability (CWE-79) caused by improper neutralization of user input during web page generation. This flaw allows attackers to inject malicious scripts that are reflected in the web response, potentially leading to client-side code execution. The vulnerability is publicly known and assigned CVE-2026-65763 with a CVSS 4.0 base score of 5.1, indicating medium severity. No vendor advisory or patch information is currently available, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact is limited by the medium severity score and the requirement for user interaction (UI:A). There is no indication of privilege escalation or server-side compromise from the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation and output encoding workarounds if feasible. Monitor official Phoca.cz and Joomla security channels for updates and patches addressing this vulnerability.