The Joomla extension iCagenda allows authenticated users to submit an event through a frontend form that stores the image and file fields as raw strings without escaping them for output. A malicious payload can be inserted into these fields and will be rendered when the event is viewed, leading to a stored cross‑site scripting vulnerability. This can compromise site integrity, allow theft of user session information, and facilitate phishing or defacement attacks.

The issue exists in the iCagenda extension for Joomla in all releases from version 4.0.8 through 4.0.12. Any installation using one of these vulnerable versions is susceptible.

The CVSS score of 8.6 categorises the vulnerability as high severity. Although the EPSS score is reported as less than 1%, indicating a low probability of current exploitation, the vulnerability is not listed in the CISA KEV catalog. Attackers must have authenticated access to the site to insert malicious content via the submit form; however, once stored, the payload executes in the context of any user who views the event, giving the attacker broad reach for defacement or credential theft.