StageIt Joomla Extension CVE-2026-105601

Exploitation requires a victim to interact - typically by clicking or loading an attacker-supplied URL containing the XSS payload - against a Joomla site running the StageIt extension in affected versions 1.0 through 5.7.5 or 6.0 through 6.3.5. No authentication or privileges are needed on the attacker side (PR:N), but the mandatory user interaction (UI:P) is the key limiting factor: without a lured victim the payload cannot execute. The specific vulnerable parameter or page component is not described in the available sources. Impact is confined to the victim's browser session (no subsequent-system impact).

This is a reflected cross-site scripting flaw (CWE-79) in the StageIt Joomla extension, rated moderate (CVSS 5.3). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N) indicates a network-reachable, low-complexity, unauthenticated attack that nonetheless REQUIRES user interaction (UI:P) - a victim must click or load an attacker-crafted link - which is the single biggest limiter on real-world risk and is typical of reflected XSS. Impact is limited to low confidentiality and low integrity within the victim's browser context; there is no availability impact and no system-level compromise. No EPSS score was provided, the CVE is NOT on the CISA KEV list, and no public exploit code is referenced (the only reference is a vendor changelog, not a PoC). The vuln.today decision label is 'this_month', signalling a routine remediation priority rather than an emergency. Overall this is a genuine but not urgent issue: real risk hinges on social-engineering a user into following a malicious link, so it is lower real-world risk than its network/unauthenticated metrics alone might suggest. Note: no vendor advisory text or exact fixed version was supplied, so the precise remediation build is not confirmed from available data.

An attacker crafts a URL for a vulnerable StageIt page with malicious JavaScript in a reflected parameter and lures a Joomla site visitor or administrator into clicking it. When the victim loads the link, the unsanitized input is reflected into the page and the script executes in the victim's browser session, potentially stealing session cookies or performing actions as that user. No public exploit code is referenced at time of analysis.