CVE-2026-76564

The Phoca Cart extension for Joomla is vulnerable to a stored cross-site scripting (XSS) attack through the User-Agent header in the Admin Order View, affecting versions 5.0.0 to 6.1.7. This vulnerability could allow an attacker to execute arbitrary scripts in the context of an admin user's session, potentially compromising sensitive data or administrative controls. Joomla site administrators using the affected versions should prioritize patching this vulnerability to mitigate the risk of exploitation.