High severity · published Aug 20, 2026
CVE-2026-75948
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12
8.6
CVSS
0.4%
EPSS
No
On KEV
Description
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `image` and `file` fields as raw strings with no output-side HTML-attribute escaping.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IE
iCagenda extension for Joomla · icagenda.com
4.0.8-4.0.12 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-75948
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-75948
www.icagenda.com
https://www.icagenda.com/
More from iCagenda extension for Joomla
9.8
CVE-2026-48939
Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15
9.2
CVE-2026-67365
Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11
8.6
CVE-2026-102790
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12
8.6
CVE-2026-71571
Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11
5.3
CVE-2026-102799
Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16