Earlier today, I released iCagenda 4.0.17. This is a security update for the iCagenda 4.x series, compatible with Joomla! 4 through Joomla! 6.
And what about Joomla 3?
Support for iCagenda version 3.9 (the final version compatible with Joomla 3) ended on October 13, 2026 (for the preceding year, this version had received only security updates).
As an exception, I have extended security support for the iCagenda PRO 3.9 version until October 13, 2027.
However, to benefit from this extended support, you must have a Pro subscription: https://www.joomlic.com/extensions/icagenda
We strongly advise users who are still using Joomla! 3 to upgrade to Joomla! 5 and Joomla! 6 as soon as possible.
- Joomla 3 reached its end-of-life in August 2023.
- iCagenda 4.x continues to support Joomla 4 as a minimum version (though using Joomla 5 or 6 is highly recommended), even though Joomla 4.4 reached its end-of-life on October 17, 2025.
Why is it important to perform updates?
Artificial intelligence is currently driving a massive surge in cybersecurity attacks, with AI-enabled threat activity skyrocketing by 89% over the past year. This isn't limited to Joomla or its extensions; the entire web is increasingly facing these kinds of attacks.
While AI assists you in your daily life or work, it also aids hackers, and everything moves faster these days.
That is why I promptly release security updates as soon as a flaw is discovered—whether it is publicly known or as yet unknown and unexploited. I handle this with complete transparency; I will never hide a vulnerability behind a generic "bug fix" label.
You should not delay in updating whenever a security version becomes available—whether it is for your operating system, your phone, your favorite app, a Joomla extension, or Joomla itself.
All users running an affected version should update immediately.
What is the vulnerability?
We deliberately choose not to publish functional proofs of concept. The goal of this article is to inform the public so that they can update as soon as possible, rather than to provide a method for attackers.
- Vulnerability #1 alone justifies an immediate update if you have any version from 3.2.1 to 4.0.16 installed on your Joomla site. A previous review of the same code covered only the
image,fileandwebsitefields, not event custom fields, so this sink had not been traced back then. - Vulnerability #2 is more limited in scope: the user has to export the file from Joomla administration and open it in a spreadsheet application.
If you cannot perform the update immediately: if this issue concerns you and you are unable to update right away, you can disable the menu item that allows event submissions from the site's public interface (frontend) and avoid exporting the list of registrations in CSV format from the Joomla administration area. This effectively neutralizes the operation in question while you wait to apply the update.
These vulnerabilities were responsibly disclosed by Akinlabi Omoogun (lulztigre.pw).
I would like to thank Akinlabi for reporting these issues and for helping me strengthen the security of iCagenda.
Security Advisory
Issue #1: Stored XSS via url-type event Custom Field
Severity: High
Probability: High
CVE Number: CVE-2026-102790
Versions affected: Versions 3.2.1 through 4.0.16 are affected.
Solution: Upgrade to version 4.0.17 or later
Reported By: Akinlabi Omoogun of lulztigre.pw
| Joomla version | Joomla 3 | Joomla 4 | Joomla 5 | Joomla 6 |
|---|---|---|---|---|
| iCagenda versions affected | 3.2.1-3.9.16 | 3.8.0-4.0.16 | 3.9.0-4.0.16 | 4.0.0-4.0.16 |
| Stored XSS vulnerability | yes | yes | yes | yes |
Issue #2: CSV formula injection in the registrations export
Severity: Medium
Probability: Low
CVE Number: CVE-2026-102799
Versions affected: Versions 3.5.0 through 4.0.16 are affected.
Solution: Upgrade to version 4.0.17 or later
Reported By: Akinlabi Omoogun of lulztigre.pw
| Joomla version | Joomla 3 | Joomla 4 | Joomla 5 | Joomla 6 |
|---|---|---|---|---|
| iCagenda versions affected | 3.5.0-3.9.16 | 3.8.0-4.0.16 | 3.9.0-4.0.16 | 4.0.0-4.0.16 |
| CSV injection vulnerability | yes | yes | yes | yes |
iCagenda 3.9 reached its end-of-life on 13 October 2026. As an exception, I have extended security support for Joomla 3, but only for the Pro version of iCagenda. A security release, version 3.9.17, is therefore available to users with a Pro subscription. The free version is no longer supported. See previous alert message about Joomla 3.
If you don't have updated yet, please update right now!
The version 4.0.17 is for Joomla 4 up to latest Joomla 6 version.
If you have any questions please post on the forum or open a new support ticket if you own an active Pro Subscription.