Phoca

An unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in PhocaCart (CVE-2026-76565) allows attackers to inject malicious JavaScript via price filter parameters.