CVE-2026-76564: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in phoca.cz Phoca Cart extension for Joomla

CVE-2026-76564 is a stored XSS vulnerability in the Phoca Cart extension for Joomla, affecting versions 5.0.0 through 6.1.7. The vulnerability arises from improper neutralization of input during web page generation, specifically via the User-Agent header in the Admin Order View. An attacker can exploit this to execute arbitrary scripts in the context of the administrator's browser session.

Successful exploitation could allow an attacker to execute arbitrary scripts in the administrator's browser, potentially leading to session hijacking, privilege escalation, or other malicious actions within the Joomla administration interface. The vulnerability is rated high severity with a CVSS 4.0 score of 8.6, indicating significant impact if exploited.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when viewing orders and consider additional protections such as web application firewalls or input filtering.