{"affected":[{"defaultStatus":"unaffected","product":"iCagenda extension for Joomla","source":"CNA: Joomla","vendor":"icagenda.com","versions":[{"status":"affected","version":"3.2.1-4.0.16"}]}],"cveId":"CVE-2026-102790","cwes":["CWE-79"],"description":"Joomla Extension - icagenda.com -  Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16","epss":{"date":"2026-11-06","percentile":0.20991,"score":0.00284},"exploits":[],"kev":null,"metrics":[{"score":8.6,"severity":"high","source":"CNA: Joomla","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793990225917,"publishedAt":1793188572050,"references":[{"source":"CNA: Joomla","tags":["product"],"url":"https://www.icagenda.com/"}],"remediation":[],"revision":"e7fb33c679619dc15e658343db22294df9df098ac098ea1420e0f55dd0f6a69e","sources":[{"modifiedAt":1793990225917,"name":"CNA: Joomla","retrievedAt":1793992128120,"url":"https://www.cve.org/CVERecord?id=CVE-2026-102790"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793992142508,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102790"}],"ssvc":{"assessedAt":1793988914880,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Joomla Extension - icagenda.com -  Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12","updatedAt":1793992142508}