CVE-2026-76564 Overview
CVE-2026-76564 is a stored Cross-Site Scripting (XSS) vulnerability in the Phoca Cart extension for Joomla. The flaw affects Phoca Cart versions 5.0.0 through 6.1.7. Attackers inject malicious script payloads through the User-Agent HTTP header when placing orders on the storefront. The payload persists in the database and executes when an administrator opens the Admin Order View in the Joomla backend. Successful exploitation runs attacker-controlled JavaScript in the administrator's authenticated browser session. This can lead to session theft, account takeover, and further compromise of the Joomla site. The weakness is tracked as [CWE-79].
Critical Impact
Unauthenticated attackers can execute JavaScript in an administrator's browser context, enabling admin account takeover and full site compromise.
Affected Products
- Phoca Cart 5.0.0 through 6.1.7
- Joomla installations using the Phoca Cart extension
- Administrator backend views that render order metadata
Discovery Timeline
- 2026-08-20 - CVE-2026-76564 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76564
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the Phoca Cart Joomla extension. Phoca Cart records the User-Agent header of the browser used to submit an order. This value is stored in the order database record without adequate sanitization or output encoding. When a Joomla administrator opens the affected order in the Admin Order View, the stored User-Agent string is rendered into the administrative HTML page.
Because the attacker controls the User-Agent header, they can substitute a crafted HTML/JavaScript payload. The payload executes in the administrator's authenticated session context. This grants the attacker access to session cookies, CSRF tokens, and any actions the admin can perform through the Joomla backend. Exploitation requires an administrator to view the malicious order, which satisfies the User Interaction (UI:A) requirement noted in the CVSS vector.
Root Cause
The root cause is improper neutralization of input during web page generation, categorized as [CWE-79]. Phoca Cart trusts the client-supplied User-Agent header and stores it verbatim. The admin-side template then emits the value without HTML entity encoding or a strict content sanitization layer.
Attack Vector
An unauthenticated remote attacker submits a request to the storefront (for example, placing or initiating an order) with a crafted User-Agent header containing script content. The malicious value is written into the order record. When an administrator opens that order in the Joomla backend, the stored payload executes in the admin's browser. The EPSS score for this CVE is 0.258% (percentile 17.668) as of 2026-08-20.
No verified public exploit code is available at this time. Refer to the Phoca Cart Overview for product context.
Detection Methods for CVE-2026-76564
Indicators of Compromise
- Order records containing User-Agent values with HTML tags such as <script>, <img, <svg, or onerror= handlers.
- Web server access logs showing storefront order submissions with anomalous or script-bearing User-Agent strings.
- Unexpected administrator account creations, permission changes, or extension installations following an admin order review session.
Detection Strategies
- Query the Phoca Cart orders table for stored User-Agent values matching HTML or JavaScript patterns.
- Inspect Joomla administrator session activity for outbound requests initiated from the Admin Order View page.
- Correlate storefront request logs with backend admin sessions to identify malicious orders viewed by privileged users.
Monitoring Recommendations
- Enable and retain web application firewall (WAF) logs for storefront endpoints handling order submission.
- Alert on Joomla administrator session anomalies, including token reuse from new IP addresses.
- Monitor for creation of new Joomla super user accounts or changes to global configuration after order review activity.
How to Mitigate CVE-2026-76564
Immediate Actions Required
- Upgrade Phoca Cart to a version later than 6.1.7 once the vendor publishes a fixed release.
- Restrict access to the Joomla administrator backend by IP allowlisting until patched.
- Audit existing orders for malicious User-Agent values and sanitize or purge affected records.
- Rotate Joomla administrator credentials and invalidate active admin sessions if suspicious orders are identified.
Patch Information
No vendor patch URL is listed in the NVD entry at the time of publication. Monitor the Phoca Cart Overview for updated releases addressing CVE-2026-76564. Apply the fixed version across all Joomla sites running the extension.
Workarounds
- Deploy a WAF rule that blocks or strips HTML tags in the User-Agent header on storefront endpoints.
- Apply server-side output encoding to any admin template that renders order metadata, including User-Agent.
- Enforce a strict Content Security Policy (CSP) in the Joomla administrator area to block inline script execution.
- Limit administrator access to trusted networks and require multi-factor authentication for backend logins.
# Example ModSecurity rule to block script payloads in User-Agent on storefront order endpoints
SecRule REQUEST_HEADERS:User-Agent "@rx (?i)(<script|onerror=|onload=|javascript:|<svg|<img[^>]+src)" \
"id:1076564,phase:1,deny,status:400,log,msg:'Blocked XSS payload in User-Agent (CVE-2026-76564)'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
