CVE-2026-85189: Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0

Q: Does disabling Modals Pro JavaScript Events prevent this issue?

No. The issue does not rely on Modals' separate Pro JavaScript Events feature; an executable browser URL scheme in authored content can still reach the generated link and iframe-loading path.

Q: Who is exposed to the stored script execution?

Visitors who load authored content containing a malicious Modals destination may have JavaScript run in their browser. Exploitation requires a party able to author or alter such content.

Published Sep 14, 2026

Updated

Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0 - Modals treats a destination using an executable browser URL scheme as an ordinary modal URL. The value can reach both the generated link and the iframe-loading path. Authored content can consequently become JavaScript in a visitor's browser without using Modals' separate Pro JavaScript Events feature.

Affected Software

1 affected component

regularlabs.com Modals extension for Joomla<17.0.0

Event History

Sep 14, 2026

CVE Published

via MITRE·06:17 AM

Data Sourced

via MITRE·06:17 AM

DescriptionWeakness

Frequently Asked Questions

Does disabling Modals Pro JavaScript Events prevent this issue?

No. The issue does not rely on Modals' separate Pro JavaScript Events feature; an executable browser URL scheme in authored content can still reach the generated link and iframe-loading path.

Who is exposed to the stored script execution?

Visitors who load authored content containing a malicious Modals destination may have JavaScript run in their browser. Exploitation requires a party able to author or alter such content.