CVE-2026-65763 is a reflected XSS vulnerability in the Phoca Maps extension for Joomla, affecting versions 5.0.0 to 6.0.4. The vulnerability is due to improper neutralization of user-supplied input during web page generation, which can lead to execution of arbitrary scripts in the context of the affected web application. This vulnerability does not require privileges or authentication and has a low attack complexity, but user interaction is required. The vulnerability has not been reported as exploited in the wild, and no official patch or remediation guidance has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected Joomla site, potentially leading to session hijacking, defacement, or redirection to malicious sites. However, the impact is limited by the requirement for user interaction and the low scope of the vulnerability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor the vendor's communications for updates. In the meantime, consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts and educate users to avoid clicking on suspicious links that could trigger the vulnerability.