VULNERABILITY INTELLIGENCE
CVE-2026-85189
EPSS probability0.42%
CISA KEVNot currently listed
Published2026-09-14
Last modified2026-09-16
Description
Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0 - Modals treats a destination using an executable browser URL scheme as an ordinary modal URL. The value can reach both the generated link and the iframe-loading path. Authored content can consequently become JavaScript in a visitor's browser without using Modals' separate Pro JavaScript Events feature.
Weakness classification
- security@joomla.org: CWE-79