Is CVE-2026-85189 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85189 being exploited in the wild.

How severe is CVE-2026-85189?

Informational severity, with a CVSS score of 5.4, published 14 September 2026.

Is there a fix for CVE-2026-85189?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85189 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85189?

Check whether you run Regular Labs Modals at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85189: Regular Labs Modals stored XSS via executable URL schemes

CVE-2026-85189 · Severity: info · CVSS 5.4 · Published 2026-09-14

The Modals extension for Joomla allows administrators to create popup windows that display content. A vulnerability allows attackers with content authoring privileges to inject malicious JavaScript code by using executable browser URL schemes (such as javascript: or data:) in modal destinations. When visitors view pages containing these manipulated modals, the injected code executes in their browsers without requiring the extension's Pro JavaScript feature, potentially leading to account compromise or data theft.

Vendors: Regular Labs.

Quick answers

Is CVE-2026-85189 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85189 being exploited in the wild.
How severe is CVE-2026-85189?: Informational severity, with a CVSS score of 5.4, published 14 September 2026.
Which products and versions are affected?: Regular Labs Modals < 17.0.0.
Is there a fix for CVE-2026-85189?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85189 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85189?: Check whether you run Regular Labs Modals at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a stored cross-site scripting (XSS) vulnerability in the Regular Labs Modals extension for Joomla. The vulnerability exists because the extension fails to properly validate or sanitize URL schemes when configuring modal destinations; it treats executable schemes (javascript:, data:, vbscript:) as ordinary modal URLs. The malicious payload is stored in the Joomla database and reaches both the generated link element and the iframe-loading code path, allowing unauthenticated site visitors to execute arbitrary JavaScript in their browser context. No patch version information was provided, but the advisory indicates versions prior to 17.0.0 are affected. Exploitation requires content authoring privileges to craft the stored payload, but execution occurs in visitor browsers without additional user interaction.

Affected products

Regular Labs Modals < 17.0.0

Timeline

2026-09-14: disclosed

References

https://www.regularlabs.com/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.