Executive brief
Quick Index is a Joomla plugin that generates a table of contents. It inserts user-supplied class values directly into HTML attributes without proper escaping, allowing an attacker with content-creation privileges to inject malicious code. An attacker could craft a class option value that breaks out of the attribute and injects JavaScript, which would execute whenever the page is viewed by any user.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Quick Index extension for Joomla. The vulnerability exists because the extension takes a configurable class option and inserts it directly into generated HTML without HTML-attribute escaping. An attacker can craft a malicious class value (e.g., '" onclick="alert(1)') that closes the intended class attribute and introduces a new executable attribute. Although Joomla's built-in content filter is applied to the authored plugin syntax, the filter cannot prevent this because Quick Index generates the final HTML output after filtering occurs, allowing the payload to bypass protection. The attack requires privileged access (the ability to author Joomla content or plugin syntax) and affects Joomla versions before 5.0.5.
Affected products
- Regular Labs Quick Index before 5.0.5
- Joomla Joomla before 5.0.5
Timeline
- 2026-09-14: disclosed: Published on NVD