The vulnerability arises in the Joomla Event Manager extension when the PDF export link includes an unescaped query string. Input supplied by an attacker can be reflected in a JavaScript or HTML context, allowing the attacker to run malicious scripts in the context of a user who clicks the link. This weakness exposes the user to theft of session tokens, credential compromise, or disclosure of sensitive data. The weakness is a reflected XSS flaw, classified as CWE‑79.

CVE‑2026‑77989 affects the Joomla Event Manager extension from joomlaeventmanager.net. Versions older than 5.0.1 are vulnerable; upgrades to 5.0.1 or later contain the fix.

The CVSS severity is 5.3, indicating a moderate impact on confidentiality, integrity, and availability. Based on the description, it can be inferred that the likely attack vector involves an attacker crafting a link that the victim must click to trigger the reflected XSS, so the exploitation requires a user to click a crafted link. The EPSS score is not available so baseline exploitation likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting it has no known widespread exploitation yet. Nonetheless, because the flaw allows arbitrary script execution, it is a serious risk for sites that expose the PDF export functionality to untrusted users.