A security flaw has been identified in the Regular Labs Tabs & Accordions Pro extension for Joomla!, officially tracked as CVE-2026-100751. This vulnerability is a type of privileged stored Cross-Site Scripting (XSS). In simple terms, it means that a malicious user could inject harmful code into a website using the affected extension. This code then gets stored on the server and runs in the web browsers of other visitors or administrators when they view the compromised content.<\/p>\n
The core of the problem lies in how the Tabs & Accordions Pro extension handles URLs. It accepts a URL for an item and embeds it into a specific HTML attribute (data-rlta-url<\/code>). Crucially, the web browser then uses this value directly with window.open()<\/code>, a function that opens new browser windows or tabs. The extension, in its vulnerable versions, does not properly check if these URLs could contain JavaScript commands. This oversight allows an attacker to bypass Joomla’s usual content filtering because the malicious behavior is created by the extension during the page rendering, rather than being caught by Joomla itself when the content is first authored.<\/p>\nCVE Details<\/h2>\n