Phoca Guestbook Extension For Joomla
Monthly
Reflected XSS in the Phoca Guestbook Joomla extension (versions 1.0.0 through 6.1.0) allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser via crafted, unsanitized URL parameters or form inputs reflected back by the extension without proper encoding. Exploitation requires the victim to click a specially crafted link (UI:A per CVSS 4.0), making phishing or social engineering the primary delivery mechanism. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Reflected XSS in the Phoca Guestbook Joomla extension (versions 1.0.0 through 6.1.0) allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser via crafted, unsanitized URL parameters or form inputs reflected back by the extension without proper encoding. Exploitation requires the victim to click a specially crafted link (UI:A per CVSS 4.0), making phishing or social engineering the primary delivery mechanism. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.