CVE-2026-105601
MediumCVSS 5.3Summary
StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a Reflected XSS vulnerability. Malicious JavaScript can be reflected in the server response and executed in the victim's browser.
Risk Assessment
An attacker can trick a user into clicking a crafted link, leading to script execution in their browser and potential session theft.
Recommendation
Update StageIt to a patched version or remove the extension if not used.
Other vulnerabilities in StageIt
See all- CVE-2026-105600High
StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a remote code execution (RCE) vulnerability via setting strings. An attacker can inject and execute arbitrary code on the server.
- CVE-2026-103420High
StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a CSRF vulnerability for various actions. An attacker can trick a logged-in administrator into performing unintended actions.
Original NVD description (English source)
Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5
Vulnerability data from NVD (NIST) · CISA KEV · EPSS