CVE-2026-76565 is a reflected XSS vulnerability in the Phoca Cart extension for Joomla, specifically in versions 5.0.0 to 6.1.7. The flaw is due to improper neutralization of input during web page generation, affecting the price_from and price_to filter parameters. This allows an attacker to inject malicious scripts that could be executed in the context of the victim's browser. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the user's browser, potentially leading to session hijacking, defacement, or other malicious actions. However, the impact is rated as medium, reflecting limited confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting the use of the affected filter parameters if possible and apply standard web application protections such as input validation and output encoding.