CVE-2026-66917: Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.3.1
Published Aug 22, 2026
·Updated
Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.3.1 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser.
Other sources
Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser.
— NVD
Affected Software
1 affected component
Joomla JoomGallery<4.3.1, <4.4.0
Event History
Aug 22, 2026
CVE Published
via MITRE·11:12 AM
Data Sourced
via MITRE·11:12 AM
DescriptionWeakness
Data Sourced
via NVD·12:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An authenticated, privileged user can exploit it by storing an XSS payload in an image.
2
Who is exposed to the stored payload?
Every visitor whose browser loads an affected image can have JavaScript execute in their browser.
3
Which versions need remediation?
JoomGallery versions earlier than 4.3.1 are affected. Upgrading to 4.3.1 or later addresses the affected version range described.