Phoca Guestbook CVE-2026-65762

Q: What is the CVSS score of CVE-2026-65762?

CVE-2026-65762 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-48331 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Joomla

GHSA-576p-fvmq-q54x

XSS Phoca Guestbook Extension For Joomla Phoca Cz

5.1

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-delivered reflected XSS with no required privileges; scope changes to victim's browser context enabling session theft, so S:C with limited C/I impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:48 vuln.today

DescriptionCVE.org

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 1.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XSS vulnerability.

AnalysisAI

Reflected XSS in the Phoca Guestbook Joomla extension (versions 1.0.0 through 6.1.0) allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser via crafted, unsanitized URL parameters or form inputs reflected back by the extension without proper encoding. Exploitation requires the victim to click a specially crafted link (UI:A per CVSS 4.0), making phishing or social engineering the primary delivery mechanism. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Technical ContextAI

This vulnerability resides in the Phoca Guestbook extension for Joomla, developed by phoca.cz and identified by CPE cpe:2.3:a:phoca.cz:phoca_guestbook_extension_for_joomla:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the reflected variant, where attacker-controlled input passed via an HTTP request parameter is echoed back in the server's HTTP response without adequate output encoding or input validation. Unlike stored XSS, the payload is not persisted in a database; it exists only within the crafted request, requiring the attacker to deliver the malicious URL to a victim. Guestbook components are a classic high-risk surface for such failures because they are designed to accept and display free-form user text, making improper sanitization a recurring pattern in this class of plugin.

RemediationAI

The primary remediation is to update the Phoca Guestbook extension to the latest version published at https://www.phoca.cz/phocaguestbook, which should include proper input validation and output encoding for the affected parameters. The exact patched version number is not confirmed from available data - administrators should verify the current release at the vendor page before updating. If immediate patching is not feasible, disable the Phoca Guestbook component via the Joomla extension manager to eliminate the attack surface entirely, accepting the trade-off of removing guestbook functionality from the site. Deploying a Web Application Firewall rule to detect and block common reflected XSS payload patterns in requests to guestbook-related endpoints provides partial mitigation but should not substitute for patching, as WAF rules are bypassable. No vendor advisory URL with specific version guidance was included in the provided references beyond the general product page.