VULNERABILITY INTELLIGENCE

CVE-2026-77989

EPSS probability0.44%
CISA KEVNot currently listed
Published2026-08-27
Last modified2026-08-28

Description

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton() echoes it unescaped, leading to an reflected XSS vector.

Weakness classification

  • security@joomla.org: CWE-79

Primary references