CVE-2026-102790EUVD-2026-112028GHSA-PFMP-23X9-8M76
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
iCagenda, an event calendar extension for the Joomla content management system, is affected. An authenticated user can store malicious scripts through a URL-type event custom field, which could run in the browsers of other users who view the affected event pages.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16
Timeline
- CVE published
- First seen by cve.now
Affected versions
- icagenda.com iCagenda extension for Joomla
3.2.1-4.0.16