Executive brief
iCagenda is a Joomla extension for managing and sharing calendar events on websites. A stored cross-site scripting (XSS) vulnerability in the frontend "Submit an Event" form allows authenticated users to inject malicious code through the image and file fields, which are stored and rendered without proper HTML escaping, potentially compromising the accounts of administrators or other users who view affected event data.
Technical details
The vulnerability is a stored XSS flaw in iCagenda versions 4.0.8 through 4.0.12. The root cause is insufficient output-side HTML-attribute escaping in the `image` and `file` fields of the frontend event submission form; attacker-controlled input is stored as raw strings and later rendered to the page without sanitization. The vulnerability requires authentication to exploit (the attacker must be able to submit events), but once a malicious payload is stored, any user viewing the affected event—including administrators—could have their session hijacked or credentials stolen. The attack vector is network-based but requires valid user credentials to reach the vulnerable form. Patch availability is not specified in the advisory.
Affected products
- JoomliC iCagenda 4.0.8 to 4.0.12
Timeline
- 2026-08-20: disclosed