CVE-2026-77993 is a reflected XSS vulnerability in the joomlack.fr Page Builder CK extension for Joomla, affecting versions 1.0.0 up to and including 3.6.4. The issue arises from improper neutralization of input in the 'iscontenttype' parameter during web page generation, classified under CWE-79. This allows an attacker to inject malicious scripts that are reflected back to users, potentially leading to script execution in their browsers. No official remediation or patch has been documented as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript in the context of the victim's browser session with the affected Joomla extension. This may lead to theft of user credentials, session hijacking, or other malicious actions performed on behalf of the user. However, the vulnerability requires user interaction (UI:P) and has low vector complexity, with limited confidentiality, integrity, and availability impact as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or web application firewall rules to filter or sanitize the 'iscontenttype' parameter. Monitoring vendor channels for updates is recommended.