Live › vulnerability › CVE-2026-102790
Go to dashboardiCagenda, an event calendar extension for Joomla, stores a URL-type event custom field without proper output sanitisation, so script can be saved and run in other users' browsers. An attacker who can enter event data can use this to run script in the context of visitors or administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 12:32 UTC. All times on this page are UTC.
Sites running the Joomla iCagenda extension in the affected version range that use a URL-type custom field on events. Sites without iCagenda, or without that custom field type in use, are less exposed. The sources do not say whether the attack needs a logged-in account.
No product ranges from the sources yet.
3.2.1 and 4.0.164.0.16 (the sources do not name the exact fixed release)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16
This page as .md · .json · in your agent: get_signal("CVE-2026-102790")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.