Skip to main content
mySites.guru
Free Audit
CriticalPHP2Shell is fixed, but a researcher now claims six more unpatched PHP flaws. Nothing to do today, but PHP is not out of the woodsWhat to prepare

Phoca Maps security vulnerabilities

mySites.guru tracks 2 vulnerabilities in Phoca Maps (com_phocamaps), covering 2 CVEs. Every connected Joomla site is checked against them on each audit.

Is my site affected?

Your site is affected if it runs Phoca Maps in any of these ranges:

  • up to and including 6.0.9
  • from 5.0.0 up to but not including 6.0.3
Latest safe version
The rules here cover more than one release line, so there is no single version that clears all of them. Use the fixed release listed for the line your site runs.
What to do
Update to the fixed release listed for your version in the table below, or to the newest release from the vendor. Where a range has no fix recorded, check the vendor's release notes before keeping Phoca Maps installed.
Check whether your sites are affected

Every Phoca Maps vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
CVE-2026-65763CVSS 5.1up to and including 6.0.9after 6.0.9Medium2026-07-23
CVE-2026-23900CVSS 6.5from 5.0.0 up to but not including 6.0.36.0.3Unrated-

What we check for

MediumCVE-2026-657632026-07-23

Phoca Maps (com_phocamaps) <= 6.0.9 - Unauthenticated Reflected XSS (CVE-2026-65763)

Phoca Maps by phoca.cz is affected by a reflected cross-site scripting vulnerability (CVE-2026-65763): improper validation of user input reflects attacker-controlled script. Affects all versions 1.0.0 through 6.0.9; fixed in 6.1.0. Complements the existing Phoca Maps stored-XSS rule (CVE-2026-23900, 5.0.0 to below 6.0.3) by extending coverage up to 6.0.9 and to older releases.

Affected versions: ≤ 6.0.9

Full advisory: nvd.nist.gov

CVE-2026-23900

Phoca Maps (com_phocamaps) 5.0.0 to below 6.0.3 - Multiple Stored XSS

Phoca Maps. CVE-2026-23900: multiple stored XSS vulnerabilities in the maps and icon rendering logic. Affects 5.0.0-6.0.2, fixed in 6.0.3.

Affected versions: ≥ 5.0.0 and < 6.0.3

Full advisory: nvd.nist.gov

Timeline

  1. 11 April 2026CVE-2026-23900 record published
  2. 23 July 2026Check added for CVE-2026-65763 (up to and including 6.0.9)
  3. 23 July 2026CVE-2026-65763 record published

References

Each CVE page above links its official cve.org record and its NVD entry.

Phoca Maps vulnerability questions

Which versions of Phoca Maps are vulnerable?
mySites.guru tracks 2 vulnerabilities in Phoca Maps (com_phocamaps). A site is affected if its installed version is in any of these ranges: up to and including 6.0.9; from 5.0.0 up to but not including 6.0.3.
What is the latest safe version of Phoca Maps?
The rules here cover more than one release line, so there is no single version that clears all of them. Use the fixed release listed for the line your site runs.
How do I check which version of Phoca Maps my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com_phocamaps. mySites.guru reads the installed version on every audit of a connected site and checks it against these rules.

Running Phoca Maps on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

CVE identifiers: CVE-2026-65763, CVE-2026-23900. Rules current as of 25 October 2026.