CVE-2026-102790: Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12

Q: What level of access does an attacker need to exploit this issue?

The issue is described as authenticated stored XSS, so the attacker needs an authenticated iCagenda account capable of supplying a URL-type event Custom Field value.

Q: Which versions should be treated as affected?

The description identifies iCagenda versions 3.2.1 through 4.0.16 as affected. The title specifically highlights versions 4.0.8 through 4.0.12.

Published Oct 28, 2026

Updated

Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16

Affected Software

1 affected component

icagenda.com iCagenda>=4.0.8<=4.0.12, >=3.2.1<=4.0.16

Event History

Oct 28, 2026

CVE Published

via MITRE·11:56 AM

Data Sourced

via MITRE·11:56 AM

DescriptionWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The issue is described as authenticated stored XSS, so the attacker needs an authenticated iCagenda account capable of supplying a URL-type event Custom Field value.

Which versions should be treated as affected?

The description identifies iCagenda versions 3.2.1 through 4.0.16 as affected. The title specifically highlights versions 4.0.8 through 4.0.12.