Executive brief
Regular Labs Tabs & Accordions is a popular Joomla extension used on over 100,000 websites to create tabbed and accordion-style content layouts. The extension contains a stored cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious JavaScript code through a specially crafted alias value. An attacker with sufficient privileges can inject code that executes in the browsers of site visitors, potentially stealing credentials, hijacking sessions, or defacing the website.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Regular Labs Tabs & Accordions extension for Joomla, affecting versions below 3.1.0. The vulnerability exists in how the extension processes the rtla-alias option when rendering links: it places the alias value directly into a quoted JavaScript argument within an HTML onclick attribute without properly escaping both the JavaScript string context and HTML attribute context. An attacker with sufficient privileges (likely an admin or content editor) can craft a malicious data-rlta-alias value that breaks out of the intended context and injects arbitrary JavaScript code. When the affected page is viewed, the malicious script executes in visitors' browsers. The vulnerability requires authenticated access to inject the payload, but affects all users who visit the compromised page.
Affected products
- Regular Labs Tabs & Accordions < 3.1.0
Timeline
- 2026-09-14: disclosed