CVE-2026-75948: Icagenda.com iCagenda Extension For Joomla

High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days.

Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `image` and `file` fields as raw strings with no output-side HTML-attribute escaping.

Affected products

• Icagenda.com iCagenda Extension For Joomla: version 4.0.8-4.0.12 only

Published 2026-08-20. Last modified 2026-08-26.