Reflected XSS and Open Redirect Vulnerability in Event Gallery Extension by SvenBlueGe
CVE-2026-97165

5.3MEDIUM

Key Information:

Vendor

Svenbluege.de

Status
Event Gallery For Joomla
Vendor
CVE Published:
27 September 2026

What is CVE-2026-97165?

The Event Gallery extension by SvenBlueGe is susceptible to a reflected Cross-Site Scripting (XSS) and open redirect vulnerability. This occurs due to the improper validation of the 'return' parameter, which is base64-decoded and then directly written to the 'Back' link. Attackers can exploit this flaw to execute arbitrary JavaScript code in the context of the user's browser or redirect users to malicious sites, potentially compromising their sensitive information.

Affected Version(s)

Event Gallery for Joomla 1.0.0-6.0.0

References

https://www.svenbluege.de/
product

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.