CVE-2026-76565

CVE-2026-76565 is identified as a reflected Cross-Site Scripting (XSS) vulnerability found within the Phoca Cart extension for Joomla. This flaw specifically impacts versions 5.0.0 through 6.1.7 of the extension. The vulnerability stems from improper output encoding of the `price_from` and `price_to` filter parameters, which are reflected directly into HTTP responses. An attacker can exploit this by crafting a malicious URL containing a JavaScript payload embedded within these parameters. When an authenticated or unauthenticated user visits this crafted URL, the arbitrary JavaScript code can be executed in their browser session. This vulnerability is categorized under CWE-79, which addresses improper neutralization of input during web page generation.