CVE-2026-23900: Phoca Maps

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.

Affected products

• Phoca Maps: from 5.0.0, up to and including 6.0.2

Published 2026-04-11. Last modified 2026-06-17.