CVE-2026-102790
HighCVSS 8.6Summary
The Joomla extension iCagenda (icagenda.com) contains a stored XSS vulnerability via a URL-type custom field in events. This affects versions 3.2.1 to 4.0.16.
Risk Assessment
An attacker could inject malicious script that executes in a user's browser, potentially leading to session theft or other attacks.
Recommendation
Update iCagenda to a version later than 4.0.16.
Other vulnerabilities in iCagenda
See all- CVE-2026-102799Medium
The Joomla extension iCagenda (icagenda.com) contains a CSV formula injection vulnerability in the registrations export. This affects versions 3.5.0 to 4.0.16.
- CVE-2026-67365Critical
The Joomla extension iCagenda before version 4.0.0-4.0.11 contains an unauthenticated SQL injection vulnerability in the mod_icagenda_calendar module. It is reachable via com_ajax without requiring a session, token, or account.
- CVE-2026-48939CriticalActively exploited
A vulnerability in the iCagenda extension for Joomla allows arbitrary file upload in the file attachment feature, leading to PHP code upload and execution.
- CVE-2026-75948High
Joomla extension iCagenda 4.0.8 to 4.0.12 has an authenticated stored XSS in the 'Submit an Event' form, where image and file fields are stored without output-side HTML-attribute escaping.
- CVE-2026-71570Medium
The Joomla extension iCagenda before version 2.0.0-4.0.11 contains an ACL bypass vulnerability allowing arbitrary user enumeration. A backend operator with access only to com_icagenda could enumerate Joomla user profiles.
- CVE-2026-67366Medium
The Joomla extension iCagenda before version 2.0.0-4.0.11 contains a CSRF vulnerability in frontend registration actions. Multiple state-changing operations in the frontend are callable without a CSRF token check.
- CVE-2026-71571High
Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL.
Original NVD description (English source)
Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16
Vulnerability data from NVD (NIST) · CISA KEV · EPSS