CVE-2026-88853: Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0
Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0 - Modals Pro intentionally supports JavaScript Events such as on-open and on-closed. Affected versions do not distinguish trusted extension configuration from event code supplied in ordinary article content. A lower-privileged author can therefore use a documented executable feature which should be reserved for trusted authors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joomla Extension - regularlabs.com - Modals Proto a version that resolves this vulnerability.Fixed in 17.0.0 - Compensating control
Ensure the documented executable JavaScript event handler options in Modals Pro (e.g., on-open and on-closed) are reserved for trusted authors only; affected versions do not distinguish trusted extension configuration from event code supplied in ordinary article content.
Event History
Frequently Asked Questions
Who can exploit this issue?
A lower-privileged author who can supply ordinary article content can exploit it by using the extension's documented JavaScript event-handler feature.
What is required for successful exploitation?
The attacker needs the ability to create or modify ordinary Joomla article content. The issue arises because affected versions treat event code in that content as trusted extension configuration.
Which versions are affected?
Modals Pro versions earlier than 17.0.0 are affected.