CVE-2026-77989

Published September 3, 2026

CVSS 4.05.3

SeverityMedium

Known exploitedNo

Joomla Extension – joomlaeventmanager.net – Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 – buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton() echoes it unescaped, leading to an reflected XSS vector.

NVD references:

https://www.joomlaeventmanager.net/

Primary source: NIST National Vulnerability Database

Stay Ahead of the Threat Landscape