EUVD-2026-63216
GHSA-wpv7-x588-92g9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable stored XSS requiring a low-privilege account and victim browser interaction; scope changes as payload executes in an administrator's elevated browser session.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the image and file fields as raw strings with no output-side HTML-attribute escaping.
AnalysisAI
Stored cross-site scripting in iCagenda Joomla extension versions 4.0.8 through 4.0.12 allows an authenticated event submitter to inject persistent JavaScript payloads via the image and file fields of the frontend 'Submit an Event' form. The injected script executes in any viewer's browser upon rendering the affected event page, with highest consequence when a Joomla administrator previews or approves the submission, enabling session hijacking and full backend compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a Joomla account with permission to access the frontend 'Submit an Event' form - corresponding to the PR:L metric in the provided CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) accurately models a low-complexity, network-reachable stored XSS requiring low-privilege authentication - corresponding to any registered user with event-submission access - and passive victim interaction, specifically an administrator or privileged user viewing the event. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a standard Joomla user account on a site running iCagenda 4.0.8-4.0.12 and navigates to the public 'Submit an Event' form, entering a JavaScript payload - such as a cookie-exfiltration script pointed at an attacker-controlled server - into the `image` or `file` field. The payload is stored unescaped in the database. … |
| Remediation | The primary fix is to upgrade the iCagenda Joomla extension to a version beyond 4.0.12 that resolves the output-escaping deficiency in the event submission form; consult the vendor advisory at https://www.icagenda.com/ for the exact patched release, as no specific fix version was confirmed in available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all iCagenda event submissions for suspicious content and restrict event submission access to administrators only; enforce input validation on image and file upload fields. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary PHP file upload in the iCagenda extension for Joomla enables remote unauthenticated attackers to abuse the eve
Cross-site request forgery in the iCagenda Joomla extension (versions prior to 4.0.11) exposes multiple frontend state-c
Access control bypass in the iCagenda Event Scheduler Extension for Joomla (all versions prior to 4.0.11) permits authen
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today