Executive brief
The Keyboard Shortcuts extension for Joomla, which allows administrators to create hotkeys for common tasks, contains a security flaw in its configuration settings. This vulnerability allows the application to accept and execute unauthorized JavaScript code within the shortcut settings. If exploited, an attacker could potentially execute malicious scripts in the context of a user's browser, leading to unauthorized actions or data theft.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the Regular Labs Keyboard Shortcuts extension for Joomla (versions 1.0.0 through 3.2.5). The issue stems from improper neutralization of input during web page generation (CWE-79) within the shortcut configuration component. Specifically, the application accepts arbitrary inline JavaScript, which can be executed in the context of an authenticated user's session. An attacker with the ability to modify shortcut configurations could inject malicious scripts to perform actions on behalf of other users or exfiltrate sensitive information.
Affected products
- Regular Labs Keyboard Shortcuts extension for Joomla 1.0.0 through 3.2.5
Timeline
- 2026-07-23: disclosed: CVE-2026-65756 published by the Joomla! Project.