CVE-2026-23900

CVE-2026-23900 encompasses multiple stored cross-site scripting (XSS) vulnerabilities discovered in the maps and icon rendering logic of the Phoca Maps component, affecting versions 5.0.0 through 6.0.2. These vulnerabilities allow attackers to inject malicious scripts that persist in the application's data storage. The vulnerability is classified as MEDIUM severity with a CVSS score of 6.5, indicating moderate risk with potential for confidentiality and integrity compromise. The attack requires no authentication or user interaction and can be executed over the network through a straightforward approach. Based on current threat intelligence, this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog and demonstrates negligible exploitation activity in the wild, though organizations using affected Phoca Maps versions should prioritize patching to versions beyond 6.0.2.