Stored XSS in Phoca Cart for Joomla Extension by phoca.cz
CVE-2026-76564

8.6HIGH

Key Information:

Vendor

Phoca.cz

Status
Phoca Cart Extension For Joomla
Vendor
CVE Published:
20 August 2026

What is CVE-2026-76564?

The vulnerability allows for stored cross-site scripting (XSS) through manipulation of the User-Agent header in the Admin Order View of Phoca Cart. This security issue can lead to an unauthorized injection of malicious scripts which would execute in the context of an administrator's session, potentially compromising sensitive information or enabling further attacks on the Joomla site.

Affected Version(s)

Phoca Cart extension for Joomla 5.0.0-6.1.7

References

https://www.phoca.cz/phocacart
product

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Toan Le
.