# CVE-2026-76565: Phoca Cart reflected XSS in price filter parameters

Source: https://junglewise.ai/threats/cve-2026-76565-phoca-cart-reflected-xss-in-price-filter-parameters  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76565 · Severity: info · Published 2026-08-20

Phoca Cart is a Joomla e-commerce extension used to build online stores and shopping cart functionality. The extension contains a reflected cross-site scripting (XSS) vulnerability in its price filtering feature that could allow an attacker to inject malicious scripts into product filter URLs. If a customer clicks a manipulated link, the attacker's JavaScript code could execute in their browser, potentially stealing account credentials or session data.

Technologies: [Phoca.cz Phoca Cart](https://junglewise.ai/threats/technologies/phoca-cart). Vendors: [Phoca.cz](https://junglewise.ai/threats/vendors/phoca-cz).

## Quick answers

**Is CVE-2026-76565 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76565 being exploited in the wild.

**How severe is CVE-2026-76565?** Informational severity, published 20 August 2026.

**Which products and versions are affected?** Phoca.cz Phoca Cart 5.0.0-6.1.7.

**Is there a fix for CVE-2026-76565?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76565 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-76565?** Check whether you run Phoca.cz Phoca Cart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reflected XSS flaw in the price_from and price_to filter parameters of Phoca Cart. These parameters are not properly sanitized or output-encoded before being displayed on the page, allowing an attacker to inject arbitrary HTML and JavaScript. The attack vector is network-based and does not require authentication; it relies on social engineering (victim clicking a malicious link). An attacker can craft a URL with JavaScript payload in the filter parameters to execute code in the victim's browser context. The vulnerability affects versions 5.0.0 through 6.1.7.

## Affected products

- phoca.cz Phoca Cart 5.0.0-6.1.7

## Timeline

- 2026-08-20: disclosed

## References

- [https://www.phoca.cz/phocacart](https://www.phoca.cz/phocacart)

## Related threats

- [Phoca Cart authorization bypass in order-file download endpoint](https://junglewise.ai/threats/cve-2026-102775-joomla-extension-phoca-cz-authorisation-bypass-through-user)
- [Phoca Cart stored XSS in User-Agent header processing](https://junglewise.ai/threats/cve-2026-76564-phoca-cart-stored-xss-in-user-agent-header-processing)