The vulnerability is an authenticated stored cross‑site scripting flaw found in the Phoca Gallery extension for Joomla. An attacker who can log into the site and upload or edit gallery items can embed malicious code in an element attribute. When that gallery content is viewed by other users, the injected code runs in their browsers. The flaw is a classic input validation weakness (CWE-79) that can lead to session hijacking, credential theft, defacement, or the installation of malware on the victim's machine.

The affected product is the Phoca Gallery Joomla extension, version 4.5.0 through 6.1.5 inclusive. Versions outside this range are assumed to be unaffected. The extension is provided by phoca.cz.

The vulnerability receives a CVSS score of 8.6, indicating high severity. The EPSS score is unavailable, so the likelihood of exploitation cannot be quantified. The CVE is not listed in the CISA KEV catalog. The likely attack vector is local, requiring the attacker to possess an authenticated Joomla account with gallery editing permissions. Because the flaw is stored, once an attacker injects content it can affect all users who view the gallery, making the impact far‑reaching.