Vulnerability · Published Sep 28, 2026 · Assigned by Joomla

CVE-2026-100751Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0

High 7.5

In plain English

A high-severity cross-site scripting in Tabs & Accordions (Free, Pro) extension for Joomla from regularlabs.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 4.0)7.5High

Exploit odds (30 days)0.2%top 93.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0 - Tabs & Accordions Pro accepts a url option for an item and writes it to a generated data-rlta-url attribute. The browser code passes that value to window.open() when the item is activated. Affected versions do not reject browser URL schemes which execute JavaScript. Joomla sees ordinary plugin syntax while filtering the authored article; Tabs & Accordions creates the executable browser behavior later while rendering the article.

Affected products (as reported)

Vendor	Product	Versions
regularlabs.com	Tabs & Accordions (Free, Pro) extension for Joomla	2.3.0-3.1.0

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/S:N/AU:N

References

https://www.regularlabs.com/ product