CVE-2026-60025

CVE-2026-60025: Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0

Vendor Joomdonation.com

Product Events Booking extension for Joomla

Weakness CWE-352 · CSRF

Published July 17, 2026

Last update August 12, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 had an frontend file upload endpoint that lacked CSRF protection.

Key dates

02Disclosure timeline

July 17, 2026 CVE published

August 12, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-60025 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html AskarLabs — CWE-352 write-up Cross-Site Request Forgery

Related vulnerabilities

04Related CVE

CVE-2026-75952 Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3 CVE-2026-65539 WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability CVE-2026-66681 WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability CVE-2025-14469 Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification CVE-2026-57751 WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability