CVE-2026-75948 is a high-severity authenticated stored XSS vulnerability in the iCagenda extension for Joomla, affecting versions 4.0.8 to 4.0.12. The issue stems from improper neutralization of input during web page generation (CWE-79), specifically in the handling of the 'image' and 'file' fields submitted via the frontend 'Submit an Event' form. These fields are stored as raw strings without output-side HTML attribute escaping, allowing an attacker with authenticated access to inject malicious scripts that could be executed in the context of other users viewing the affected pages.

Successful exploitation allows an authenticated attacker to inject and store malicious scripts in the 'image' and 'file' fields of event submissions. These scripts execute in the browsers of users who view the affected content, potentially leading to session hijacking, privilege escalation, or other malicious actions within the Joomla site context. The vulnerability requires authenticated access but has high impact due to the stored nature of the XSS and the high CVSS score of 8.6.

No official patch or remediation level is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to trusted users only and consider disabling or limiting the use of the 'Submit an Event' form to reduce exposure.