Skip to content
OpenAdvisories
High · 7.5 CVE-2026-88853 EUVD-2026-77309GHSA-xc7p-wr44-hv2x

Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0

Published Sep 14, 2026 · Updated Sep 15, 2026 · Assigned by Joomla

Description

Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0 - Modals Pro intentionally supports JavaScript Events such as on-open and on-closed. Affected versions do not distinguish trusted extension configuration from event code supplied in ordinary article content. A lower-privileged author can therefore use a documented executable feature which should be reserved for trusted authors.

Affected products

VendorProductAffectedFixed
regularlabs.com Modals (Pro) extension for Joomla 4.7.0-16.2.0 —

References