Affected versions: ≥ 4.0.0 and < 4.0.17
Full advisory: our disclosure post
CVE-2026-102790HighAdded to mySites.guru 27 October 2026
iCagenda (com_icagenda) below 4.0.17 (3.9.17 PRO on Joomla 3) - Stored XSS via URL Custom Field and CSV Formula Injection in Registrations Export
JoomliC released iCagenda 4.0.17 (Joomla 4, 5 and 6) and iCagenda PRO 3.9.17 (Joomla 3) on 27 October 2026 to fix two security issues. CVE-2026-102790, rated High by the vendor: the value of a url-type event custom field sent through the front-end event submission form was saved without validation and printed into a link with no escaping and no check on the link scheme, so a submitted event could carry JavaScript that runs in the browser of anyone who views it, including administrators. Submitting needs whatever access level the site gives the submission form, which is Registered by default and anonymous only where the site opened it to Public. CVE-2026-102799, rated Medium: the registrations CSV export did not neutralise cells beginning with = + - or @, so a name, email, note or custom field value entered on the registration form could run as a spreadsheet formula when an administrator opens the export. JoomliC lists 3.2.1 to 4.0.16 as affected by the XSS and 3.5.0 to 4.0.16 by the CSV injection. We confirmed both changes by comparing the public 4.0.16 and 4.0.17 packages. Reported by Akinlabi Omoogun of lulztigre.pw. Not a mySites.guru finding. Both CVE ids are reserved; the CVE records are not yet published. Update to 4.0.17 on Joomla 4, 5 or 6. On Joomla 3, 3.9.17 is available only with an iCagenda PRO subscription, because the free 3.9 line reached end of life on 13 October 2026; the lasting fix is to move the site to Joomla 5 or 6 and iCagenda 4.0.17. Until updated, disable the menu item for front-end event submission and do not open registration exports in a spreadsheet.
Is my site affected?
CVE-2026-102790 is checked by 2 rules. Find the extension and release line your site runs:
How severe CVE-2026-102790 is
The published CVE record has no CVSS score, so there is no vector to break down here. mySites.guru rates it High, and that is the rating your sites are checked against.
Timeline
- 27 October 2026mySites.guru check added for iCagenda (from 4.0.0 up to but not including 4.0.17)
- 27 October 2026mySites.guru check added for iCagenda (from 3.2.1 up to but not including 3.9.17)
- 27 October 2026We published: iCagenda 4.0.17 Fixes a Stored XSS in Event Custom Fields
Rule details
iCagenda - iCagenda (com_icagenda) below 4.0.17 (3.9.17 PRO on Joomla 3) - Stored XSS via URL Custom Field and CSV Formula Injection in Registrations Export
JoomliC released iCagenda 4.0.17 (Joomla 4, 5 and 6) and iCagenda PRO 3.9.17 (Joomla 3) on 27 October 2026 to fix two security issues. CVE-2026-102790, rated High by the vendor: the value of a url-type event custom field sent through the front-end event submission form was saved without validation and printed into a link with no escaping and no check on the link scheme, so a submitted event could carry JavaScript that runs in the browser of anyone who views it, including administrators. Submitting needs whatever access level the site gives the submission form, which is Registered by default and anonymous only where the site opened it to Public. CVE-2026-102799, rated Medium: the registrations CSV export did not neutralise cells beginning with = + - or @, so a name, email, note or custom field value entered on the registration form could run as a spreadsheet formula when an administrator opens the export. JoomliC lists 3.2.1 to 4.0.16 as affected by the XSS and 3.5.0 to 4.0.16 by the CSV injection. We confirmed both changes by comparing the public 4.0.16 and 4.0.17 packages. Reported by Akinlabi Omoogun of lulztigre.pw. Not a mySites.guru finding. Both CVE ids are reserved; the CVE records are not yet published. Update to 4.0.17 on Joomla 4, 5 or 6. On Joomla 3, 3.9.17 is available only with an iCagenda PRO subscription, because the free 3.9 line reached end of life on 13 October 2026; the lasting fix is to move the site to Joomla 5 or 6 and iCagenda 4.0.17. Until updated, disable the menu item for front-end event submission and do not open registration exports in a spreadsheet.
Affected versions: ≥ 3.2.1 and < 3.9.17
Full advisory: our disclosure post
Our disclosure post
Other vulnerabilities in iCagenda
Updating for CVE-2026-102790 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.
iCagenda
Latest safe version: 4.0.17
- CVE-2026-48939 Critical, from 4.0.0 up to but not including 4.0.8
- CVE-2026-102799 High, from 4.0.0 up to but not including 4.0.17
- CVE-2026-67365 from 4.0.8 up to but not including 4.0.12
- CVE-2026-71571 from 4.0.8 up to but not including 4.0.12
- CVE-2026-67366 from 4.0.8 up to but not including 4.0.12
- CVE-2026-71570 from 4.0.8 up to but not including 4.0.12
References
- CVE-2026-102790 on cve.org (the official CVE record)
- CVE-2026-102790 in the NIST National Vulnerability Database
- iCagenda 4.0.17 Fixes a Stored XSS in Event Custom Fields
CVE-2026-102790 questions
Which versions are affected by CVE-2026-102790?
CVE-2026-102790 is covered by 2 rules: iCagenda from 4.0.0 up to but not including 4.0.17; iCagenda from 3.2.1 up to but not including 3.9.17.
How do I fix CVE-2026-102790?
It depends on the extension and release line your site runs. For iCagenda from 4.0.0 up to but not including 4.0.17: update iCagenda to 4.0.17 or later. For iCagenda from 3.2.1 up to but not including 3.9.17: update iCagenda to 3.9.17 or later.
How severe is CVE-2026-102790?
The published CVE record has no CVSS score. mySites.guru rates it High.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 27 October 2026.