Quick answers
- Is CVE-2026-75948 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-75948 being exploited in the wild.
- How severe is CVE-2026-75948?
- Informational severity, published 20 August 2026.
- Which products and versions are affected?
- JoomliC iCagenda 4.0.8 to 4.0.12.
- Is there a fix for CVE-2026-75948?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-75948 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-75948?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a stored XSS flaw in iCagenda versions 4.0.8 through 4.0.12. The root cause is insufficient output-side HTML-attribute escaping in the `image` and `file` fields of the frontend event submission form; attacker-controlled input is stored as raw strings and later rendered to the page without sanitization. The vulnerability requires authentication to exploit (the attacker must be able to submit events), but once a malicious payload is stored, any user viewing the affected event—including administrators—could have their session hijacked or credentials stolen. The attack vector is network-based but requires valid user credentials to reach the vulnerable form. Patch availability is not specified in the advisory.
Affected products
- JoomliC iCagenda 4.0.8 to 4.0.12
Timeline
- 2026-08-20: disclosed