Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-85191

Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Joomla

Description

Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0 - Tabs & Accordions rewrites links matching an item alias into calls to its browser API. The affected renderer places the alias inside a quoted JavaScript argument in an HTML onclick attribute without securing both the JavaScript-string and HTML-attribute contexts. A crafted data-rlta-alias value can therefore change the generated handler.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

regularlabs.com Tabs & Accordions (Free, Pro) extension for Joomla

Default version status: unaffected

  • 1.0.0-3.0.5affected

References