Executive brief
The Modals extension for Joomla allows administrators to create popup windows that display content. A vulnerability allows attackers with content authoring privileges to inject malicious JavaScript code by using executable browser URL schemes (such as javascript: or data:) in modal destinations. When visitors view pages containing these manipulated modals, the injected code executes in their browsers without requiring the extension's Pro JavaScript feature, potentially leading to account compromise or data theft.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Regular Labs Modals extension for Joomla. The vulnerability exists because the extension fails to properly validate or sanitize URL schemes when configuring modal destinations; it treats executable schemes (javascript:, data:, vbscript:) as ordinary modal URLs. The malicious payload is stored in the Joomla database and reaches both the generated link element and the iframe-loading code path, allowing unauthenticated site visitors to execute arbitrary JavaScript in their browser context. No patch version information was provided, but the advisory indicates versions prior to 17.0.0 are affected. Exploitation requires content authoring privileges to craft the stored payload, but execution occurs in visitor browsers without additional user interaction.
Affected products
- Regular Labs Modals < 17.0.0
Timeline
- 2026-09-14: disclosed