CVE-2026-103420
HighCVSS 7.2Summary
StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a CSRF vulnerability for various actions. An attacker can trick a logged-in administrator into performing unintended actions.
Risk Assessment
Unauthorized operations can be performed on behalf of the administrator, potentially leading to configuration changes or data loss.
Recommendation
Update StageIt to a patched version; consider disabling the extension until then.
Other vulnerabilities in StageIt
See all- CVE-2026-105601Medium
StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a Reflected XSS vulnerability. Malicious JavaScript can be reflected in the server response and executed in the victim's browser.
- CVE-2026-105600High
StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a remote code execution (RCE) vulnerability via setting strings. An attacker can inject and execute arbitrary code on the server.
Original NVD description (English source)
Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5
Vulnerability data from NVD (NIST) · CISA KEV · EPSS