Authenticated Stored XSS in iCagenda Joomla Extension

CVE-2026-75948

What is CVE-2026-75948?

CVE-2026-75948 is a vulnerability identified in the iCagenda Joomla Extension, specifically affecting versions 4.0.8 to 4.0.12. iCagenda is a popular extension used within the Joomla content management system for managing event calendars. This particular vulnerability manifests as an Authenticated Stored Cross-Site Scripting (XSS) flaw, where the "Submit an Event" form inadequately handles user inputs. The fields meant for images and files are stored as raw strings without proper HTML-attribute escaping, creating a potential attack vector for malicious users. If successfully exploited, this vulnerability can allow an attacker to execute arbitrary JavaScript code in the context of authenticated users, which poses serious security risks for organizations utilizing this extension.

Potential impact of CVE-2026-75948

1. Data Breach Risk: Exploitation of this vulnerability could allow attackers to gain unauthorized access to sensitive information by leveraging XSS techniques, leading to potential data breaches that compromise user data and organizational integrity.

2. Credential Theft: With the ability to execute scripts within the context of affected users, attackers could harvest usernames, passwords, and session tokens, facilitating further unauthorized access to accounts and systems.

3. Reputation Damage: If an organization falls victim to an attack leveraging this vulnerability, it may suffer significant reputational harm as clients and users lose trust in its ability to protect sensitive information and maintain secure systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

This is an advertDeploy the Patch →

References