CVE-2026-76564 is a stored XSS vulnerability (CWE-79) in the Phoca Cart extension for Joomla, affecting versions 5.0.0 through 6.1.7. The vulnerability occurs due to improper sanitization of the User-Agent HTTP header in the Admin Order View, allowing malicious script injection that persists and executes when an administrator views the order details. The CVSS 4.0 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity. No official patch or remediation guidance is currently available from the vendor.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the Joomla administrator's browser session. This may lead to theft of sensitive information, session hijacking, or other malicious actions performed with administrator privileges. The vulnerability is remotely exploitable without authentication but requires user interaction (administrator viewing the order).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when viewing order details and consider additional protections such as web application firewalls or input filtering at the network level. Monitor official Phoca.cz and Joomla advisories for updates.