CVE-2026-76565MediumCVSS 5.3CVE published 20 August 2026Added to mySites.guru 20 August 2026

Phoca Cart (com_phocacart) 6.1.7 - Unauthenticated Stored XSS via User-Agent in the Admin Order View (CVE-2026-76564) and Reflected XSS in the product price filter

Q: Which versions are affected by CVE-2026-76565?

CVE-2026-76565 is covered by 2 rules: Phoca Cart from 6.1.7 up to but not including 6.1.8; Phoca Cart from 5.2.4 up to and including 5.2.4.

Q: How do I fix CVE-2026-76565?

It depends on the extension and release line your site runs. For Phoca Cart from 6.1.7 up to but not including 6.1.8: update Phoca Cart to 6.1.8 for this flaw, or to 6.1.9 or later, which no rule we check matches. For Phoca Cart from 5.2.4 up to and including 5.2.4: update Phoca Cart to the newest release from the vendor. This flaw covers versions up to 5.2.4, so any later release is outside it.

Q: How severe is CVE-2026-76565?

Joomla CNA scores it 5.3 (Medium) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and someone has to visit a page.

Phoca Cart echoes the price_from and price_to request parameters straight into the value attribute of the product filter text inputs, in the site layouts form_filter_text.php and form_filter_horizontal_text.php, with no escaping. No login is required: a crafted link to a shop category or product list page whose price_from value contains a double quote breaks out of the attribute and runs attacker script in the browser of anyone who opens it. The filter panel is rendered on the public shop pages whenever the price filter is enabled. 6.1.8 wraps both values in htmlspecialchars with ENT_QUOTES and ENT_SUBSTITUTE, and also escapes an unescaped value in the administrator Phoca Render Adminview helper. Confirmed by diffing the released com_phocacart zips on 2026-08-18. Update to 6.1.8. Note that 6.1.7 was itself the fix for the CVE-2026-74251 product filter SQL injection, so a site on 6.1.7 is exposed to this cross site scripting issue only, not to the SQL injection. Published by the Joomla CNA on 20 August 2026 as CVE-2026-76565 (the price filter reflected XSS, CVSS 4.0 5.3 Medium) and CVE-2026-76564 (CVSS 4.0 8.6 High): the visitor's User-Agent header is stored with the order and rendered unescaped in the administrator order view, so an anonymous shopper can plant script that runs when a shop manager opens the order. Both CVEs give 5.0.0 to 6.1.7 as affected.

Is my site affected?

CVE-2026-76565 is checked by 2 rules. Find the extension and release line your site runs:

Extension	Affected versions	Fixed in	What to do
Phoca Cart	from 6.1.7 up to but not including 6.1.8	6.1.8	Update Phoca Cart to 6.1.8 for this flaw, or to 6.1.9 or later, which no rule we check matches.
Phoca Cart	from 5.2.4 up to and including 5.2.4	after 5.2.4	Update Phoca Cart to the newest release from the vendor. This flaw covers versions up to 5.2.4, so any later release is outside it.

Check whether your sites are affected

How CVE-2026-76565 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

5.3 Medium

CVSS 4.0, scored by Joomla CNA

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

How it is reached

AV:N Attack vector: Network. Reachable across the internet
AC:L Attack complexity: Low. Nothing to work around, it just works
AT:N Attack requirements: None. Works against any affected install
PR:N Privileges required: None. No account needed
UI:P User interaction: Passive. Someone has to visit a page

What it does to the site

VC:L Confidentiality: Low. Some data can be read
VI:L Integrity: Low. Some data can be altered
VA:L Availability: Low. The site slows or stutters

What it does beyond the site

SC:N Confidentiality: None. Other systems keep their data
SI:N Integrity: None. Other systems keep their integrity
SA:N Availability: None. Other systems stay up

The rule below is rated High for the set of 2 CVEs it covers together, not for this record on its own.

Timeline

20 August 2026CVE-2026-76565 record published by its CNA
20 August 2026mySites.guru check added for Phoca Cart (from 6.1.7 up to but not including 6.1.8)
20 August 2026mySites.guru check added for Phoca Cart (from 5.2.4 up to and including 5.2.4)

Rule details

HighCVE-2026-76564 CVE-2026-765652026-08-20

Phoca Cart

Affected versions: ≥ 6.1.7 and < 6.1.8

Full advisory: github.com

HighCVE-2026-76564 CVE-2026-765652026-08-20

Phoca Cart - Phoca Cart (com_phocacart) 5.2.4 - Unauthenticated Stored XSS via User-Agent in the Admin Order View and Reflected XSS in the product price filter, no fixed 5.x release

Phoca Cart echoes the price_from and price_to request parameters straight into the value attribute of the product filter text inputs, in the site layouts form_filter_text.php and form_filter_horizontal_text.php, with no escaping. No login is required: a crafted link to a shop category or product list page whose price_from value contains a double quote breaks out of the attribute and runs attacker script in the browser of anyone who opens it. The filter panel is rendered on the public shop pages whenever the price filter is enabled. 6.1.8 wraps both values in htmlspecialchars with ENT_QUOTES and ENT_SUBSTITUTE, and also escapes an unescaped value in the administrator Phoca Render Adminview helper. Confirmed by diffing the released com_phocacart zips on 2026-08-18. The escaping fix has so far shipped on the 6.x branch only, in 6.1.8. Version 5.2.4 is the current 5.x release, and the released com_phocacart_v5.2.4.zip was checked on 2026-08-18 and still ships both filter layouts unescaped, so there is no fixed 5.x release yet. Move to 6.1.8 if the site can run the 6.x branch, otherwise disable the price filter until Phoca backports the fix. Versions below 5.2.4 are already flagged for the CVE-2026-74251 SQL injection. Published by the Joomla CNA on 20 August 2026 as CVE-2026-76565 (price filter reflected XSS, CVSS 4.0 5.3 Medium) and CVE-2026-76564 (stored XSS via the User-Agent header in the administrator order view, CVSS 4.0 8.6 High), both affecting 5.0.0 to 6.1.7.

Affected versions: ≥ 5.2.4 and ≤ 5.2.4

Full advisory: github.com

Other vulnerabilities in Phoca Cart

Updating for CVE-2026-76565 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

Phoca Cart

Latest safe version: 6.1.9

CVE-2026-74251 Critical, from 3.0.0 up to but not including 4.0.0
CVE-2026-102775 High, from 3.0.0 up to but not including 6.1.9
CVE-2026-76564 High, from 6.1.7 up to but not including 6.1.8

References

CVE-2026-76565 questions

Which versions are affected by CVE-2026-76565?

CVE-2026-76565 is covered by 2 rules: Phoca Cart from 6.1.7 up to but not including 6.1.8; Phoca Cart from 5.2.4 up to and including 5.2.4.

How do I fix CVE-2026-76565?

It depends on the extension and release line your site runs. For Phoca Cart from 6.1.7 up to but not including 6.1.8: update Phoca Cart to 6.1.8 for this flaw, or to 6.1.9 or later, which no rule we check matches. For Phoca Cart from 5.2.4 up to and including 5.2.4: update Phoca Cart to the newest release from the vendor. This flaw covers versions up to 5.2.4, so any later release is outside it.

How severe is CVE-2026-76565?

Joomla CNA scores it 5.3 (Medium) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and someone has to visit a page.

Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

Rules current as of 15 November 2026.