Stored XSS Vulnerability in iCagenda Joomla Extension
CVE-2026-102790

8.6HIGH

Key Information:

Vendor

Icagenda.com

Status
Icagenda Extension For Joomla
Vendor
CVE Published:
28 October 2026

What is CVE-2026-102790?

The iCagenda Joomla extension has a stored Cross-Site Scripting (XSS) vulnerability, which can be exploited through a url-type event Custom Field. Versions affected include iCagenda 3.2.1 through 4.0.16. This vulnerability allows attackers to inject malicious scripts into user interactions, potentially leading to unauthorized access and data breaches. Ensuring your Joomla system and its extensions are up to date is crucial to protecting against such exploitation.

Affected Version(s)

iCagenda extension for Joomla 3.2.1-4.0.16

References

https://www.icagenda.com/
product

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Akinlabi Omoogun of lulztigre.pw
.