CVE-2026-76565: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in phoca.cz Phoca Cart extension for Joomla

CVE-2026-76565 is a reflected XSS vulnerability in the Phoca Cart extension for Joomla, specifically in versions 5.0.0 to 6.1.7. The flaw occurs due to improper sanitization of the price_from and price_to filter parameters during web page generation, enabling an attacker to inject malicious scripts that could be executed in the context of a victim's browser. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of a user's browser session when they interact with the vulnerable parameters, potentially leading to session hijacking, information disclosure, or other client-side impacts. However, the impact is rated medium, reflecting limited confidentiality, integrity, and availability consequences.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting use of the affected parameters or applying web application firewall rules to detect and block malicious input targeting these parameters.