CVE-2026-85190: Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5
Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5 - Quick Index inserts configurable class values into generated HTML without escaping them for an HTML attribute. A crafted value can close the intended class attribute and introduce a new attribute. Joomla's content filter cannot reliably prevent this because Quick Index creates the executable HTML after the authored plugin syntax was filtered.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joomla extension (regularlabs.com) - Quick Indexto a version that resolves this vulnerability.Fixed in 5.0.5 - Compensating control
Because Joomla's content filter cannot reliably prevent this issue for Quick Index, apply an external compensating control such as restricting access to pages that allow privileged authoring/editing of the Quick Index class option to trusted users only.
Event History
Frequently Asked Questions
Which Quick Index versions are affected?
Quick Index versions earlier than 5.0.5 are affected.
Can Joomla's content filter be relied on to block this issue?
No. The filter cannot reliably prevent the issue because Quick Index generates the executable HTML after the authored plugin syntax has been filtered.