Is CVE-2026-77989 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77989 being exploited in the wild.

How severe is CVE-2026-77989?

Informational severity, published 27 August 2026.

Which products and versions are affected?

Joomla Events Manager Events Manager < 5.0.1.

Is there a fix for CVE-2026-77989?

A patch was published on 2026-09-14: Fixed in version 5.0.1 released 14 September 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77989 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-77989?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77989: Joomla Events Manager reflected XSS in PDF export link

Q: Is there a fix for CVE-2026-77989?

A patch was published on 2026-09-14: Fixed in version 5.0.1 released 14 September 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-77989 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-77989?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77989 · Severity: info · Published 2026-08-27

Joomla Events Manager is a free Joomla extension that helps organizations create and manage events, venues, calendars, and registrations on their websites. A reflected cross-site scripting (XSS) vulnerability in the PDF export feature allows attackers to inject malicious scripts into event pages through a crafted link, potentially capturing user credentials or performing unauthorized actions on behalf of visitors.

Quick answers

Is CVE-2026-77989 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77989 being exploited in the wild.
How severe is CVE-2026-77989?: Informational severity, published 27 August 2026.
Which products and versions are affected?: Joomla Events Manager Events Manager < 5.0.1.
Is there a fix for CVE-2026-77989?: A patch was published on 2026-09-14: Fixed in version 5.0.1 released 14 September 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77989 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-77989?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This reflected XSS vulnerability exists in the buildCurrentPdfLink function, which copies the current request query string into the PDF button URL without proper sanitization. The pdfbutton() function then echoes this unescaped data directly into the page, allowing attackers to inject arbitrary JavaScript. The vulnerability affects Joomla Events Manager versions prior to 5.0.1 and requires no authentication—an attacker simply needs to craft a malicious URL with XSS payload in the query string and trick a user into clicking it. The attack vector is network-based and does not require user interaction beyond clicking a link. The vulnerability has been fixed in version 5.0.1 and later.

Affected products

Joomla Events Manager Events Manager < 5.0.1

Timeline

2026-08-27: disclosed
2026-09-14: patched: Fixed in version 5.0.1 released 14 September 2026

References

https://www.joomlaeventmanager.net/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.