The vulnerability allows an attacker to store malicious script code in the maps‑ or icon rendering logic of Phoca Maps for Joomla. When another user views the affected map, the script is executed in that user’s browser. This can lead to theft of session cookies, credential hijacking, or the injection of further malware. The weakness corresponds to CWE‑79, indicating Cross‑Site Scripting.

Phoca Maps for Joomla versions 5.0.0 through 6.0.2 from phoca.cz are affected. The problem exists in the maps and icon rendering modules, where user‑supplied content is not properly escaped.

The CVSS score is 6.5, placing it in the medium severity range. The EPSS score is below 1%, suggesting a low probability that the vulnerability will be actively exploited. It is not currently listed in CISA’s KEV catalog. The likely attack vector is through the web interface, where an attacker can inject script into map or icon fields that are later rendered for all visitors. Successful exploitation requires that the attacker be able to add or edit map content, which may be restricted to authenticated users with editing privileges.