EUVD-2026-47913
GHSA-9g7h-rhcq-6c63
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Shortcut configuration in Joomla requires at minimum a basic authenticated role (PR:L); Changed Scope reflects XSS execution in victim browser; no availability impact.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
2DescriptionCVE.org
Shortcut configuration accepted arbitrary inline JavaScript.
AnalysisAI
Cross-site scripting in the Keyboard Shortcuts extension for Joomla (versions 1.0.0-3.2.5) by Regular Labs allows injection of arbitrary JavaScript via the shortcut configuration interface, executing in the browser context of any user who subsequently triggers the affected shortcut. The Changed Scope (S:C) in the CVSS vector confirms script execution crosses into the victim's session context, enabling session hijacking, credential theft, or unauthorized site actions. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' both indicate low-probability opportunistic targeting.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied input within a shortcut definition - specifically an inline JavaScript value - is accepted and stored without adequate sanitization or output encoding. The affected software is identified by CPE cpe:2.3:a:regularlabs.com:keyboard_shortcuts_extension_for_joomla:*:*:*:*:*:*:*:* and spans all releases from 1.0.0 through 3.2.5. Joomla is a PHP-based CMS whose extension ecosystem is responsible for its own input validation; the Regular Labs Keyboard Shortcuts extension failed to restrict the shortcut action field to safe values, permitting raw JavaScript to be embedded and persisted. When the stored shortcut is triggered in a victim's browser, the injected code executes within the site's DOM context - a classic stored (persistent) XSS scenario confirmed by the Changed Scope metric in the CVSS vector.
RemediationAI
No exact patched version number is independently confirmed in the available data. Administrators should immediately check the Regular Labs website (https://regularlabs.com/) for a Keyboard Shortcuts extension release above version 3.2.5 and upgrade if one is available. As a compensating control, restrict access to the shortcut configuration interface to only the highest-trust Joomla administrator roles - this directly eliminates the attack surface for non-admin exploitation with no functional impact on end users who only trigger (not configure) shortcuts. Alternatively, temporarily disabling the extension until a verified patch is applied removes the risk entirely, with the trade-off of losing keyboard shortcut functionality site-wide. Deploying a Content Security Policy (CSP) header that prohibits inline script execution (script-src 'self') provides a defense-in-depth measure against this class of XSS but may break other site functionality and requires testing before production deployment.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today