A reflected cross-site scripting (XSS) vulnerability exists in the Joomla Extension php-web-design.com StageIt versions 1.0 through 5.7.5 and 6.0 through 6.3.5. This vulnerability allows an attacker to inject malicious scripts that are reflected off the web server, potentially leading to limited confidentiality and integrity impacts. The issue is identified as CVE-2026-105601 with a medium severity rating and a CVSS 4.0 base score of 5.3.