iCagenda’s url‑type event Custom Field can store unsanitized JavaScript. An attacker with site‑administrator credentials can submit a payload that is later rendered when any user views the event. This stored XSS can lead to session hijacking, credential theft, or defacement of the site. The weakness is a classic HTML injection flaw (CWE‑79).

The vulnerability applies to the iCagenda extension for Joomla versions 3.2.1 through 4.0.16 produced by icagenda.com. No other products or Joomla core versions are listed as affected.

The CVSS score of 8.6 places the flaw in the high severity range. No EPSS data is available, and it is not listed in the CISA KEV catalog. Because authentication is required, the likely attack vector is local or internal; an attacker who compromises Joomla credentials can exploit the flaw. The combination of high severity and requirement for authentication means the risk is significant for sites with insecure credential management or exposed admin accounts.