← CVE Intelligence

CVE-2026-100751

Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0 PUBLISHED

Description (CNA)

Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0 - Tabs & Accordions Pro accepts a url option for an item and writes it to a generated data-rlta-url attribute. The browser code passes that value to window.open() when the item is activated. Affected versions do not reject browser URL schemes which execute JavaScript. Joomla sees ordinary plugin syntax while filtering the authored article; Tabs & Accordions creates the executable browser behavior later while rendering the article.

Affected (CNA)

Vendor / productVersions
regularlabs.com / Tabs & Accordions (Free, Pro) extension for Joomlaaffected 2.3.0-3.1.0

CWE

CWE-79

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.