Modals Pro Extension CVE-2026-88853

Exploitation requires an authenticated Joomla user account with at least the Author role (content creation rights). The Modals Pro extension (regularlabs.com) must be installed, licensed, and active on the target Joomla site. The attacker must have the ability to publish or submit articles that contain Modals Pro modal shortcodes with event handler parameters. Exploitation is further limited by the requirement that a victim with higher privileges must view the attacker's crafted article for the stored XSS payload to fire. Default Joomla installations without the Modals Pro extension are entirely unaffected, and sites where all article authors are fully trusted administrators are not at meaningful risk from privilege escalation via this path.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N) scores 7.5. The AT:P (Attack Topology Present) flag correctly signals that a specific precondition - an Author account - is required, meaningfully limiting exploitability. However, PR:H likely overstates the privilege level: in Joomla's permission hierarchy, 'Author' is a low-to-medium trust role, not an administrator, making PR:L a more accurate reflection. The UI:N designation in CVSS 4.0 is defensible for stored XSS in the sense that the attacker performs no ongoing interaction after planting the payload, though a victim must visit the page. No EPSS score, KEV listing, or public POC is provided, placing real-world exploitation risk in the moderate category. The attack is gated by the need for an authenticated Joomla account and the Modals Pro extension being installed and active - significantly narrowing the exposed population compared to the raw score.

An authenticated Joomla Author crafts an article that includes a Modals Pro shortcode with a malicious JavaScript payload in the on-open or on-closed event handler parameter, then publishes or submits it for review. When a Joomla administrator or higher-privileged editor opens or previews the article, the modal fires automatically and executes the injected script in that user's browser, enabling session cookie theft or unauthorized privileged actions on behalf of the victim.