Authenticated Stored XSS in Phoca Gallery by Phoca.cz
CVE-2026-102786

8.6HIGH

Key Information:

Vendor

Phoca.cz

Status
Phoca Gallery Extension For Joomla
Vendor
CVE Published:
23 October 2026

What is CVE-2026-102786?

Phoca Gallery, a Joomla extension by Phoca.cz, is vulnerable to authenticated stored cross-site scripting (XSS) due to improper handling of HTML attribute injection. This vulnerability affects multiple versions from 4.5.0 to 6.1.5, allowing attackers with valid user credentials to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, data theft, or manipulation of the web application's user interface.

Affected Version(s)

Phoca Gallery extension for Joomla 4.5.0-6.1.5

References

https://www.phoca.cz/
product

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.