CVE-2026-76569 is a reflected XSS vulnerability in the Phoca Download extension for Joomla, affecting versions 5.0.0 to 6.1.4. The flaw occurs due to improper sanitization of the search GET parameter, which can be exploited to inject malicious scripts into web pages generated by the extension. This vulnerability is identified as CWE-79 and has a CVSS 4.0 base score of 5.3, indicating medium severity. No official patch or remediation level has been published as of the data provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or redirection to malicious sites. However, the impact is rated medium, reflecting limited scope or complexity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation or filtering on the search GET parameter to mitigate reflected XSS risks. Monitoring vendor communications for updates is recommended.