CVE-2026-75948

The iCagenda extension for Joomla versions 4.0.8 to 4.0.12 is vulnerable to an authenticated stored cross-site scripting (XSS) attack through the "Submit an Event" form, where the `image` and `file` fields are improperly handled as raw strings without necessary HTML-attribute escaping. This flaw allows attackers with authenticated access to inject malicious scripts, potentially compromising user sessions and data integrity. Joomla administrators and developers using affected versions should prioritize patching this vulnerability to mitigate risks associated with XSS attacks.