CVE-2026-77989
CVE-2026-77989
Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton() echoes it unescaped, leading to an reflected XSS vector.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (17.1th percentile) — read the EPSS interpretation.
Weakness classification (CWE)
References
- security@joomla.org (product)