Is CVE-2026-100751 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100751 being exploited in the wild.

How severe is CVE-2026-100751?

Informational severity, published 28 September 2026.

Which products and versions are affected?

Regular Labs Tabs & Accordions Pro 2.3.0 to 3.1.0.

Is there a fix for CVE-2026-100751?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100751 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100751?

Check whether you run Regular Labs Tabs & Accordions Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100751: Regular Labs Tabs & Accordions Pro stored XSS via URL attributes

CVE-2026-100751 · Severity: info · Published 2026-09-28

Tabs & Accordions Pro, a Joomla extension for creating tabbed and accordion content, contains a stored cross-site scripting (XSS) vulnerability that allows authenticated administrators to inject malicious JavaScript. When a tab or accordion item's URL option is configured with a JavaScript scheme (javascript:), the extension fails to sanitize it before rendering, causing the script to execute in users' browsers. This could lead to session hijacking, credential theft, or malware distribution to site visitors.

Vendors: Regular Labs.

Quick answers

Is CVE-2026-100751 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100751 being exploited in the wild.
How severe is CVE-2026-100751?: Informational severity, published 28 September 2026.
Which products and versions are affected?: Regular Labs Tabs & Accordions Pro 2.3.0 to 3.1.0.
Is there a fix for CVE-2026-100751?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100751 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100751?: Check whether you run Regular Labs Tabs & Accordions Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored XSS in the Tabs & Accordions Pro extension where URL parameters are written directly to data-rlta-url attributes without validation of dangerous protocols. The browser code then passes this attribute value to window.open(), executing any embedded JavaScript. The vulnerability bypasses Joomla's content filters because the malicious payload is authored as plugin syntax that appears benign at filter time but becomes executable during rendering; affected versions do not reject javascript: or other executable URL schemes.

Affected products

Regular Labs Tabs & Accordions Pro 2.3.0 to 3.1.0

Timeline

2026-09-28: disclosed

References

https://www.regularlabs.com/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.