Tabs & Accordions EUVD-2026-88105

Requires an authenticated Joomla user with article/content-authoring privileges (PR:H) on a site running Regular Labs Tabs & Accordions Pro 2.3.0-3.1.0, who supplies a JavaScript-executing browser URL scheme in an item's url option. Exploitation further requires a victim to actively activate the affected tab/accordion item (attack requirement AT:P) so the browser invokes window.open() on the attacker-controlled value; it does not fire on passive page load. It is limited to sites with this specific paid extension installed and enabled, and to attackers who already hold content-creation rights.

This is a genuinely moderate, not high, real-world risk. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L, base 7.5) rates confidentiality and integrity impact as HIGH, which is aggressive for a browser-side stored XSS - a reflected/stored XSS typically yields limited (not total) compromise of the victim's session, so VC:H/VI:H likely overstates impact. Two strong limiting signals temper the score: PR:H means the attacker must already hold privileged content-authoring rights in Joomla, and AT:P (attack requirement) reflects that a victim must actively activate the tab/accordion item before window.open() fires the malicious URL scheme - effectively user interaction. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. Net: a real but self-contained privileged stored-XSS requiring an authenticated author plus victim interaction - a patch-in-normal-cycle issue, not an emergency. Note conflict: vendor VC:H/VI:H is inconsistent with a browser-scheme XSS and should be verified against the vendor advisory (only the regularlabs.com homepage is referenced, no dedicated advisory URL).

An attacker with Joomla article-authoring privileges inserts a Tabs & Accordions Pro item whose url option uses a JavaScript-executing browser scheme (e.g. javascript:). Joomla's content filter passes the ordinary-looking plugin syntax, and the extension later renders it into a data-rlta-url attribute; when a victim (potentially an administrator reviewing the article) activates the tab, the browser calls window.open() on the value and executes attacker script in their session. No public POC or active exploitation is reported.