EUVD-2026-77308
GHSA-72vc-r8gq-9v5v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:X/U:X
Stored XSS requires a privileged author to plant the payload (PR:H) and a victim to load the page (UI:R); execution context shifts to victim browser (S:C) with limited but real confidentiality and integrity impact.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
3DescriptionCVE.org
Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0 - Tabs & Accordions rewrites links matching an item alias into calls to its browser API. The affected renderer places the alias inside a quoted JavaScript argument in an HTML onclick attribute without securing both the JavaScript-string and HTML-attribute contexts. A crafted data-rlta-alias value can therefore change the generated handler.
AnalysisAI
Stored cross-site scripting in regularlabs.com's Tabs & Accordions (Free and Pro) extension for Joomla, versions prior to 3.1.0, allows a privileged authenticated attacker to inject and permanently persist arbitrary JavaScript into page output by supplying a crafted value in the rtla-alias configuration field. The extension's link-rewriting renderer embeds the alias directly into an HTML onclick attribute as a JavaScript string argument, applying neither JavaScript-string escaping nor HTML-attribute encoding, so a crafted alias breaks both quoting contexts and executes in every subsequent visitor's browser. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the Tabs & Accordions extension by regularlabs.com must be installed, active, and running a version prior to 3.1.0 on the target Joomla site; (2) the attacker must hold an authenticated Joomla account with sufficient content-creation or editing privileges to configure a Tabs & Accordions element and set a custom rtla-alias value - typically the Author, Editor, or Administrator role; (3) the crafted element must be saved to and published on a page accessible to intended victims. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.5 is shaped primarily by the PR:H constraint, which restricts the attacker pool to Joomla users holding Author, Editor, or Administrator roles capable of creating or editing Tabs & Accordions content. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Tabs & Accordions extension to version 3.1.0 or later from the vendor at https://www.regularlabs.com/; no specific advisory URL was available in the provided references, so consult the extension's changelog or the regularlabs.com downloads page to confirm the patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify the integrity of Tabs & Accordions extension by checking the rtla-alias configuration field for suspicious entries and restrict administrative access to extension settings if recent unauthorized changes are detected. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today