CVE-2026-76565: Phoca Cart Reflected XSS Vulnerability

CVE-2026-76565 Overview

CVE-2026-76565 is a reflected Cross-Site Scripting (XSS) vulnerability in the Phoca Cart extension for Joomla. The flaw resides in the price_from and price_to filter parameters, which are reflected in HTTP responses without proper output encoding. Affected versions include Phoca Cart 5.0.0 through 6.1.7. An attacker can craft a malicious URL that, when visited by an authenticated or unauthenticated user, executes arbitrary JavaScript in the victim's browser session. The vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed under the victim's browser context on Joomla storefronts running Phoca Cart.

Affected Products

Phoca Cart 5.0.0 (Joomla extension)
Phoca Cart versions 5.0.0 through 6.1.7
Joomla installations bundling the Phoca Cart storefront component

Discovery Timeline

2026-08-20 - CVE-2026-76565 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76565

Vulnerability Analysis

The vulnerability affects the price filtering feature of Phoca Cart, a shopping cart extension for the Joomla content management system. Phoca Cart accepts price_from and price_to query parameters to filter product listings by price range. The extension reflects these parameter values back into the rendered HTML response without applying context-appropriate output encoding or input sanitization.

Because the parameters flow directly into the page markup, an attacker can inject arbitrary JavaScript payloads through crafted request URIs. When a victim loads the malicious link, the browser executes the attacker's script within the origin of the vulnerable Joomla site.

Reflected XSS in an e-commerce context is particularly consequential. Attackers can target administrators, harvest session cookies, submit fraudulent orders, or modify DOM elements to capture payment data entered by shoppers.

Root Cause

The root cause is missing input validation and output encoding on the price_from and price_to filter parameters before they are echoed into the response HTML. The extension trusts client-supplied filter values and does not enforce that they conform to a numeric type before rendering.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker delivers a crafted URL containing a JavaScript payload embedded in the price_from or price_to parameter. Common delivery methods include phishing emails, malicious links posted on forums, and search engine result manipulation. No authentication is required to construct or deliver the payload.

A description of the exploitation pattern: the attacker appends a script-bearing value to the vulnerable filter parameter on a product listing URL. When the target renders the resulting page, the reflected payload executes in the victim's browser under the origin of the Phoca Cart store. See the Phoca Cart Overview for product context.

Detection Methods for CVE-2026-76565

Indicators of Compromise

HTTP request logs containing price_from or price_to parameters with values including <script, onerror=, javascript:, or URL-encoded equivalents such as %3Cscript
Referrer headers pointing to external domains delivering crafted Phoca Cart URLs to internal users
Unexpected outbound requests from browsers to attacker-controlled domains originating from Joomla store pages

Detection Strategies

Deploy web application firewall rules that inspect query strings on Phoca Cart endpoints for HTML tags and JavaScript event handlers in numeric filter parameters
Review Joomla and web server access logs for anomalous query strings on product listing URLs containing the price_from and price_to parameters
Correlate reflected XSS attempts with subsequent administrator session activity to identify successful compromise

Monitoring Recommendations

Enable verbose HTTP request logging on Joomla front-end controllers handling Phoca Cart filters
Monitor Content Security Policy (CSP) violation reports for inline script execution on product listing pages
Alert on repeated requests to Phoca Cart URLs from single source addresses with malformed filter parameter values

How to Mitigate CVE-2026-76565

Immediate Actions Required

Identify all Joomla installations running Phoca Cart versions 5.0.0 through 6.1.7 and prioritize them for remediation
Restrict administrator access to the Joomla back end from trusted networks only until patching is complete
Deploy WAF signatures that block script tags and JavaScript event handlers in price_from and price_to query parameters

Patch Information

Refer to the Phoca Cart project site for updated releases addressing the reflected XSS in the price filter parameters. Upgrade to a fixed version once released by the vendor and validate the fix in a staging environment before production deployment.

Workarounds

Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Add server-side or WAF-based validation that rejects non-numeric values submitted to price_from and price_to
Educate administrators and customers to avoid clicking untrusted links referencing the storefront

bash

# Example WAF rule concept (ModSecurity syntax)
SecRule ARGS:price_from|ARGS:price_to "@rx (?i)(<script|onerror=|javascript:|%3Cscript)" \
    "id:1076565,phase:2,deny,status:403,msg:'CVE-2026-76565 Phoca Cart XSS attempt'"