CVE-2026-66917
HighPublished
Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0
- Published
- Aug 22, 2026
- Updated
- Aug 24, 2026
- Assigning CNA
- Joomla
- Evidence observed
- Aug 24, 2026
Primary CVSS
8.6/ 10High
Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0
nvd · CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XLow · next 30 days
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser.
IDOR + Stored XSS via Broken Object-Level Authorization in JoomGallery
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.