CVE-2026-75948: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in icagenda.com iCagenda extension for Joomla

CVE-2026-75948 is a high-severity stored XSS vulnerability in the iCagenda extension for Joomla, specifically affecting versions 4.0.8 to 4.0.12. The flaw arises because the frontend 'Submit an Event' form stores the 'image' and 'file' input fields as raw strings without applying output-side HTML attribute escaping. This improper neutralization of input during web page generation (CWE-79) enables an authenticated attacker to inject malicious scripts that can execute in other users' browsers when they view the stored content.

Successful exploitation of this vulnerability could allow an authenticated attacker to execute arbitrary scripts in the context of other users, potentially leading to session hijacking, privilege escalation, or other malicious actions within the Joomla site. The CVSS 4.0 score of 8.6 indicates a high impact with network attack vector, low attack complexity, and partial user interaction required.

No official patch or remediation information is provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to trusted users only and consider disabling or restricting the use of the vulnerable 'Submit an Event' form to mitigate risk.