Live › vulnerability › CVE-2026-105601
The StageIt extension for Joomla has a reflected cross-site scripting flaw in the versions listed. An attacker can get a victim's browser to run script in the context of the Joomla site when the victim opens a crafted link.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 14:23 UTC. All times on this page are UTC.
Joomla sites with the StageIt extension installed in the listed version ranges are exposed. The sources do not say which request parameters are involved or whether the flaw needs a logged-in user. Sites without StageIt can skip it.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5
This page as .md · .json · in your agent: get_signal("CVE-2026-105601")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.