CVE-2026-77989

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton() echoes it unescaped, leading to an reflected XSS vector.

  • Published Aug 27, 2026
  • CVSS 5.3 medium
  • 0.4% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-77989 at the National Vulnerability Database