Stored XSS in Phoca Cart for Joomla Extension by phoca.cz
CVE-2026-76564

8.6HIGH

Key Information:

Vendor

Phoca.cz

Status
Phoca Cart Extension For Joomla
Vendor
CVE Published:
20 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-76564?

The vulnerability allows for stored cross-site scripting (XSS) through manipulation of the User-Agent header in the Admin Order View of Phoca Cart. This security issue can lead to an unauthorized injection of malicious scripts which would execute in the context of an administrator's session, potentially compromising sensitive information or enabling further attacks on the Joomla site.

Affected Version(s)

Phoca Cart extension for Joomla 5.0.0-6.1.7

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-76564
Created by toanln-cov

References

https://www.phoca.cz/phocacart
product

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Toan Le
.