CVE-2026-76569

The Phoca Download extension for Joomla versions 5.0.0 to 6.1.4 is vulnerable to reflected cross-site scripting (XSS) attacks through the search GET parameter. This vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's session, potentially leading to data theft or session hijacking. Joomla site administrators using the affected versions should prioritize patching or updating to mitigate this risk.