Vulnerability · Published Sep 14, 2026 · Assigned by Joomla

CVE-2026-88853Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0

High 7.5

In plain English

A high-severity cross-site scripting in Modals (Pro) extension for Joomla from regularlabs.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 4.0)7.5High

Exploit odds (30 days)0.4%top 63.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0 - Modals Pro intentionally supports JavaScript Events such as on-open and on-closed. Affected versions do not distinguish trusted extension configuration from event code supplied in ordinary article content. A lower-privileged author can therefore use a documented executable feature which should be reserved for trusted authors.

Affected products (as reported)

Vendor	Product	Versions
regularlabs.com	Modals (Pro) extension for Joomla	4.7.0-16.2.0

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/S:N/AU:N

References

https://www.regularlabs.com/ product