CVE-2026-77989: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in joomlaeventmanager.net JEM - Joomla Event Manager extension for Joomla

CVE-2026-77989 is a reflected XSS vulnerability in the JEM - Joomla Event Manager extension for Joomla. The vulnerability occurs in versions 1.0.0 through 5.0.0 where the function buildCurrentPdfLink copies the current request query string into the PDF button URL, and the pdfbutton() function echoes this URL without escaping. This improper neutralization of input (CWE-79) allows an attacker to inject malicious scripts via the PDF export link, potentially leading to script execution in the context of the victim's browser.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript in the context of the affected user's browser. This may lead to session hijacking, defacement, or other actions permitted by the victim's privileges. However, the vulnerability requires user interaction (UI:P) and has low vector complexity and impact on confidentiality, integrity, and availability, resulting in a medium severity rating.

No official patch or remediation guidance is currently available for this vulnerability. Users of the JEM extension should monitor the vendor's advisories for updates. In the meantime, consider implementing web application firewall (WAF) rules to detect and block malicious input targeting the PDF export functionality. Avoid clicking on suspicious PDF export links received from untrusted sources.