Security
iCagenda security update fixes stored XSS and CSV injection
JoomliC has issued security releases for the Joomla extension iCagenda, fixing stored cross-site scripting and CSV formula injection vulnerabilities.
mySites.guru reported that the stored XSS issue affects iCagenda versions 3.2.1 through 4.0.16. A user able to submit an event could place script in a URL-type custom field, which would execute when the event was viewed. JoomliC rates this issue High and assigned CVE-2026-102790.
The second flaw, CVE-2026-102799, affects versions 3.5.0 through 4.0.16. Values entered during registration could be interpreted as spreadsheet formulas when an administrator opened a CSV export. The vendor rates it Medium. Both CVE records are reserved and do not yet have official CVSS scores.
- For Joomla 4, 5 and 6, install
iCagenda 4.0.17. - For Joomla 3, install
iCagenda PRO 3.9.17; the free 3.9 branch has no fix. - If upgrading is not immediately possible, disable front-end event submissions and CSV registration exports.
The advisory reports no statement that either issue is being exploited in the wild, and neither CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
Originally reported by mySites.guru.