This vulnerability (CVE-2026-66917) involves improper neutralization of input during web page generation (CWE-79) in the JoomGallery extension for Joomla. Specifically, authenticated privileged users can store malicious JavaScript payloads in images, leading to stored XSS that executes in every visitor's browser. The affected versions are from 4.0.0 up to and including 4.3.0. The CVSS 4.0 score is 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been provided in the available data.

Successful exploitation allows an authenticated privileged user to inject persistent malicious scripts into images, which execute in the browsers of all visitors viewing those images. This can lead to theft of sensitive information, session hijacking, or other malicious actions executed in the context of the affected website. The vulnerability affects confidentiality, integrity, and availability of the web application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to trusted individuals only and monitor for suspicious activity related to image content. Avoid exposing the vulnerable versions in public-facing environments if possible.