---
id: "CVE-2026-102790"
kind: "vulnerability"
aliases: ["CVE-2026-102790"]
title: "iCagenda Joomla extension: stored XSS through URL-type event custom field"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["icagenda", "joomla", "other", "self-hosted"]
not_affected_if: ["default-config", "no-icagenda"]
published_at: "2026-10-28T12:17:39+00:00"
first_seen_at: "2026-10-28T12:32:51+00:00"
updated_at: "2026-10-28T12:33:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102790", "first_seen_at": "2026-10-28T12:32:51+00:00"}]
---

# iCagenda Joomla extension: stored XSS through URL-type event custom field

iCagenda, an event calendar extension for Joomla, stores a URL-type event custom field without proper output sanitisation, so script can be saved and run in other users' browsers. An attacker who can enter event data can use this to run script in the context of visitors or administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed iCagenda version in the Joomla extensions manager and see whether it falls between `3.2.1` and `4.0.16`
- Look for a url-type custom field on events in the iCagenda configuration

## Fix

- Update iCagenda to a version later than `4.0.16` (the sources do not name the exact fixed release)

## Timeline

- 2026-10-28T12:32:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102790

## From the sources

Joomla Extension - icagenda.com -  Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_