{"id":"CVE-2026-102790","kind":"vulnerability","aliases":["CVE-2026-102790"],"related":[],"title":"iCagenda Joomla extension: stored XSS through URL-type event custom field","description":"Joomla Extension - icagenda.com -  Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16","summary":"iCagenda, an event calendar extension for Joomla, stores a URL-type event custom field without proper output sanitisation, so script can be saved and run in other users' browsers. An attacker who can enter event data can use this to run script in the context of visitors or administrators.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["icagenda","joomla","other","self-hosted"],"not_affected_if":["default-config","no-icagenda"],"how_to_check":"- Check the installed iCagenda version in the Joomla extensions manager and see whether it falls between `3.2.1` and `4.0.16`\n- Look for a url-type custom field on events in the iCagenda configuration","fix":"- Update iCagenda to a version later than `4.0.16` (the sources do not name the exact fixed release)","status":"open","published_at":"2026-10-28T12:17:39+00:00","first_seen_at":"2026-10-28T12:32:51+00:00","triaged_at":"2026-10-28T12:33:45+00:00","updated_at":"2026-10-28T12:33:45+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-28T12:33:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update iCagenda to a version later than `4.0.16` (the sources do not name the exact fixed release)","reach":"internet","title":"iCagenda Joomla extension: stored XSS through URL-type event custom field","impact":"medium","summary":"iCagenda, an event calendar extension for Joomla, stores a URL-type event custom field without proper output sanitisation, so script can be saved and run in other users' browsers. An attacker who can enter event data can use this to run script in the context of visitors or administrators.","category":"other","nicknames":[],"who_cares":["joomla","icagenda","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in visitors' and admins' browsers","analyst_note":"Confirm the fixed iCagenda version and whether editing event data requires an account, using the NVD entry and the vendor advisory.","how_to_check":"- Check the installed iCagenda version in the Joomla extensions manager and see whether it falls between `3.2.1` and `4.0.16`\n- Look for a url-type custom field on events in the iCagenda configuration","needs_analyst":true,"not_affected_if":["no-icagenda","default-config"],"who_is_affected":"Sites running the Joomla iCagenda extension in the affected version range that use a URL-type custom field on events. Sites without iCagenda, or without that custom field type in use, are less exposed. The sources do not say whether the attack needs a logged-in account.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.0006,"input_tokens":3282,"output_tokens":544,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102790':15A,18A '-2026':14A,17A '3.2.1':89C '4.0.16':91C 'administr':74B 'attack':56B 'browser':54B 'calendar':28B 'context':70B 'custom':11A,38B,85C 'cve':13A,16A 'data':61B 'enter':59B 'event':10A,27B,37B,60B,84C 'extens':3A,29B,76C 'field':12A,39B,86C 'host':24B 'icagenda':1A,19B,25B,88C 'icagenda.com':77C 'joomla':2A,20B,31B,75C 'output':42B 'proper':41B 'run':50B,66B 'sanitis':43B 'save':48B 'script':45B,67B 'self':23B 'self-host':22B 'store':4A,32B,78C 'type':9A,36B,83C 'url':8A,35B,82C 'url-typ':7A,34B,81C 'use':63B 'user':53B 'via':80C 'visitor':72B 'without':40B 'xss':5A,79C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Joomla iCagenda extension in the affected version range that use a URL-type custom field on events. Sites without iCagenda, or without that custom field type in use, are less exposed. The sources do not say whether the attack needs a logged-in account.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T12:17:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102790","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102790","severity":null,"published_at":"2026-10-28T12:17:39+00:00","modified_at":"2026-10-28T12:17:39+00:00","first_seen_at":"2026-10-28T12:32:51+00:00","fetched_at":"2026-10-28T12:32:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}