Phoca Cart CVE-2026-76565

Exploitation requires a victim user to click a specially crafted URL pointing to a Joomla site running Phoca Cart 5.0.0-6.1.7 with the price filter feature active on a product listing page (UI:P per CVSS vector). The attacker requires no authentication on the Joomla site (PR:N per CVSS vector). Exploitation is limited to reflected delivery - there is no stored XSS vector indicated, so persistent compromise of other site visitors without ongoing link distribution is not applicable. Sites that have disabled or removed the price_from/price_to filter UI, or that run a WAF blocking script injection in query parameters, would not be exploitable. The vulnerability does not affect the Joomla core; only installations with the Phoca Cart extension in the stated version range are affected.

The CVSS 4.0 base score of 5.3 (Medium) is consistent with a reflected XSS that requires user interaction (UI:P), limiting opportunistic mass exploitation. Attack vector is network (AV:N) and no authentication is required from the attacker (PR:N), meaning any unauthenticated actor can generate malicious links. However, the UI:P constraint is a meaningful real-world barrier - victims must be socially engineered into clicking a crafted URL. No EPSS data was provided in the input and no KEV listing exists, indicating no confirmed mass exploitation. The scope is limited to the Phoca Cart e-commerce context: the most realistic impact is session cookie theft or redirection of shoppers to phishing pages, which carries meaningful risk on an e-commerce site handling payment flows. Overall, this is a genuine medium-priority issue for Joomla sites running Phoca Cart in the stated version range, but is not an emergency outside of high-value retail deployments.

An attacker targeting an online store built with Joomla and Phoca Cart 5.0.0-6.1.7 crafts a product listing URL with a JavaScript payload injected into the price_from or price_to parameter and distributes it via phishing email or a compromised link on a third-party site. When a shopper clicks the link, the malicious script executes in their browser under the origin of the Joomla shop, enabling the attacker to steal session cookies or silently redirect the victim to a phishing checkout page. No public proof-of-concept code has been identified, meaning exploitation currently requires independent development of the payload.