CVE-2026-85191: Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0

Q: Who would need to supply the malicious value for exploitation to occur?

The issue is described as privileged stored XSS, so exploitation requires a privileged user who can provide a crafted data-rlta-alias value that is processed by the extension.

Q: How can I determine whether my installation is in the affected version range?

Check the installed Tabs & Accordions extension version. Versions earlier than 3.1.0 are identified as affected.

Q: What kind of content should be reviewed for signs of exposure?

Review content containing links or extension markup that uses the data-rlta-alias value, especially values that may contain crafted characters intended to alter a generated onclick handler.

Published Sep 14, 2026

Updated

Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0 - Tabs & Accordions rewrites links matching an item alias into calls to its browser API. The affected renderer places the alias inside a quoted JavaScript argument in an HTML onclick attribute without securing both the JavaScript-string and HTML-attribute contexts. A crafted data-rlta-alias value can therefore change the generated handler.

Affected Software

1 affected component

Regular Labs Tabs & Accordions extension for Joomla<3.1.0

Event History

Sep 14, 2026

CVE Published

via MITRE·06:13 AM

Data Sourced

via MITRE·06:13 AM

DescriptionWeakness

Frequently Asked Questions

Who would need to supply the malicious value for exploitation to occur?

The issue is described as privileged stored XSS, so exploitation requires a privileged user who can provide a crafted data-rlta-alias value that is processed by the extension.

How can I determine whether my installation is in the affected version range?

Check the installed Tabs & Accordions extension version. Versions earlier than 3.1.0 are identified as affected.

What kind of content should be reviewed for signs of exposure?

Review content containing links or extension markup that uses the data-rlta-alias value, especially values that may contain crafted characters intended to alter a generated onclick handler.