CVE-2026-76564 HIGH

CVE-2026-76564: Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7

Vendor Phoca.cz

Product Phoca Cart extension for Joomla

Weakness CWE-79 · XSS

Published August 20, 2026

Last update August 20, 2026

View on NVD All CVEs

CVSS base score

8.6/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7

Explanation of Vulnerability in Simple Terms

02Summary

Phoca Cart extension for Joomla versions 5.0.0 through 6.1.7 contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in the browsers of site visitors. The vulnerability requires user interaction—typically clicking a crafted link—to trigger the attack. Site administrators should update to a version newer than 6.1.7 when available.

What an attacker can do

03Attacker Capabilities

Inject malicious scripts that run in visitors' browsers, potentially stealing session tokens or redirecting users.

Potential impact on your site

04Site Impact

Visitors' browsers may execute attacker-controlled JavaScript, risking credential theft and malware distribution.

Conditions required to exploit

05Prerequisites

Network access and user interaction required; victim must click a malicious link or visit a compromised page.

Key dates

06Disclosure timeline

August 20, 2026 CVE published

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-76564 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities