Cross-site Scripting and Open Redirect in Joomla Extension by Svenbluege
CVE-2026-102778

5.3MEDIUM

Key Information:

Vendor

Svenbluege.de

Status
Event Gallery For Joomla
Vendor
CVE Published:
5 October 2026

What is CVE-2026-102778?

The Event Gallery extension for Joomla has a vulnerability that allows cross-site scripting and open redirects. When the 'Share article links' feature is enabled, the share mini page can display the original article link without proper validation or escaping. This flaw could allow attackers to craft malicious links that execute scripts in the context of a user's session or redirect users to potentially harmful sites. No modifications are made to the server, but the risk to users is significant if they interact with compromised links.

Affected Version(s)

Event Gallery for Joomla 1.0.0-6.6.0

References

https://www.svenbluege.de/
product

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.