CVE-2026-76565

The Phoca Cart extension for Joomla versions 5.0.0 to 6.1.7 is vulnerable to reflected cross-site scripting (XSS) attacks through the price_from and price_to filter parameters. This vulnerability could allow an attacker to execute arbitrary JavaScript in the context of a user's browser, potentially leading to session hijacking or data theft. Joomla administrators and web developers using this extension should prioritize patching or mitigating this vulnerability to protect their users.