Alex Joseph
Understanding the Vulnerability
A security flaw has been identified in the Regular Labs Tabs & Accordions Pro extension for Joomla!, officially tracked as CVE-2026-100751. This vulnerability is a type of privileged stored Cross-Site Scripting (XSS). In simple terms, it means that a malicious user could inject harmful code into a website using the affected extension. This code then gets stored on the server and runs in the web browsers of other visitors or administrators when they view the compromised content.
The core of the problem lies in how the Tabs & Accordions Pro extension handles URLs. It accepts a URL for an item and embeds it into a specific HTML attribute (data-rlta-url). Crucially, the web browser then uses this value directly with window.open(), a function that opens new browser windows or tabs. The extension, in its vulnerable versions, does not properly check if these URLs could contain JavaScript commands. This oversight allows an attacker to bypass Joomla’s usual content filtering because the malicious behavior is created by the extension during the page rendering, rather than being caught by Joomla itself when the content is first authored.
CVE Details
- Product: Regular Labs Tabs & Accordions Pro for Joomla!
- Published: September 28, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
The vulnerability impacts specific versions of the Regular Labs Tabs & Accordions Pro extension for Joomla! users. If you are using this extension, be aware that versions from 2.3.0 up to and including 3.1.0 are affected.
Current Status
The status of this vulnerability is “Analyzed.” This means the issue has been thoroughly investigated, and its characteristics, such as severity and impact, have been determined.
Severity Level
Rated as “Medium” severity with a CVSS Score of 6.1, this XSS vulnerability is a serious concern. A medium severity rating indicates that while an attack might not be immediately devastating or easily exploitable by a casual attacker, it still poses a significant risk. Successful exploitation could lead to unauthorized actions being performed on behalf of a logged-in user, session hijacking, defacement of the website, or the theft of sensitive data from visitors viewing the compromised pages. For administrators, this could mean an attacker gaining control over parts of the website by executing administrative functions through their browser.
Possible Solutions
As no specific patch information was available from the vendor’s primary site at the time of this writing, it is crucial for administrators and developers to take proactive steps:
- Update Immediately: Keep a close eye on the Regular Labs Tabs & Accordions product page or the official Joomla Extensions Directory for any announcements regarding security patches or updated versions. It is always best practice to update your extensions to the latest stable and secure releases as soon as they become available.
- Input Validation and Sanitization: Implement stringent input validation and output sanitization for any user-supplied data, especially in fields that can accept URLs or other executable content. This helps ensure that malicious scripts cannot be injected in the first place.
- Content Security Policy (CSP): Consider implementing a robust Content Security Policy (CSP) on your Joomla! website. A well-configured CSP can significantly reduce the impact of XSS attacks by restricting which scripts can run on your pages.
- Regular Security Audits: Conduct regular security audits and penetration testing of your Joomla! installations and extensions to identify and address vulnerabilities before they can be exploited.
Staying informed about security updates from Regular Labs and the Joomla! project is your best defense against such vulnerabilities.
References
https://www.regularlabs.com/
