iCagenda EUVD-2026-112028

Exploitation requires an authenticated Joomla account with sufficient privilege to create or edit an iCagenda event and populate a url-type event Custom Field (reflected in PR:L), so it is not remote-unauthenticated. The payload is stored, but triggering requires a second user to view the affected event page (UI:P), meaning no execution occurs without victim interaction. Exploitation is limited to deployments running the iCagenda extension at versions 3.2.1 through 4.0.16 where the url-type Custom Field feature is used; the exact trigger/rendering context beyond the url-type Custom Field is not further detailed in the available sources.

This is a stored cross-site scripting flaw (CWE-79) in the iCagenda events extension for Joomla, affecting versions 3.2.1 through 4.0.16. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P, VC:H/VI:H/VA:L) yields an 8.6 'High' score, but several signals temper real-world urgency: PR:L means the attacker must already hold a low-privileged authenticated account able to create or edit an event and populate a url-type Custom Field, and UI:P means a victim must subsequently load the affected page for the script to fire. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided, so there is no evidence of active or automatable exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a credible but not critically urgent issue. Note a tension between the vendor-assigned impact and the mechanism: VC:H/VI:H is aggressive for a stored XSS whose real impact is typically session/credential theft and actions in the victim's browser rather than full confidentiality/integrity loss of the server - this appears to be a conservative (worst-case) impact rating rather than a confirmed full-system compromise. No EPSS, KEV, or POC data was supplied; absence of these is noted, not treated as a defect.

A low-privileged but authenticated Joomla user with rights to create or edit an iCagenda event submits an event whose url-type Custom Field contains a malicious payload; because the input is stored and later rendered without adequate sanitization, the script executes in the browser of any user (potentially an administrator) who views the event. No public exploit code is identified at time of analysis. Exploitation requires both the prior authenticated injection (PR:L) and a victim visiting the page (UI:P).