Modals Free Pro Extension For Joomla
Monthly
Stored cross-site scripting in the Regular Labs Modals extension for Joomla (all versions before 17.0.0) allows high-privileged content authors to inject executable browser URL schemes - such as javascript: - into modal destination fields, which the extension passes unvalidated into both the generated anchor href and the iframe source path. When any site visitor subsequently renders the affected page, the stored payload executes as JavaScript in their browser without requiring the Pro JavaScript Events feature to be enabled. No public exploit has been identified at time of analysis; the vendor-released fix is version 17.0.0.
Stored cross-site scripting in the Regular Labs Modals extension for Joomla (all versions before 17.0.0) allows high-privileged content authors to inject executable browser URL schemes - such as javascript: - into modal destination fields, which the extension passes unvalidated into both the generated anchor href and the iframe source path. When any site visitor subsequently renders the affected page, the stored payload executes as JavaScript in their browser without requiring the Pro JavaScript Events feature to be enabled. No public exploit has been identified at time of analysis; the vendor-released fix is version 17.0.0.