CVE-2026-66917

The JoomGallery extension prior to version 4.4.0 is vulnerable to stored cross-site scripting (XSS), allowing authenticated users with sufficient privileges to embed malicious JavaScript in images. This results in the execution of the payload in the browsers of all visitors, potentially leading to session hijacking or data theft. Joomla administrators and users of the affected extension should prioritize updating to the latest version to mitigate this high-severity risk.