CVE-2026-85189

Regular Labs' Modals extension for Joomla, in all versions before 17.0.0, treats a modal destination that uses an executable browser URL scheme (such as javascript:) as an ordinary modal URL. A user with high authoring privileges can store such a destination in content, and the value flows unchecked into both the generated link and the iframe-loading path. When a visitor views the content or opens the modal, the stored value can execute as JavaScript in that visitor's browser — bypassing Modals' separate, gated Pro JavaScript Events feature — enabling session/cookie theft or actions in the victim's context, up to administrator account takeover. Any Joomla site running Modals below 17.0.0 is affected, with practical risk concentrated on sites where semi-trusted users hold authoring or editing permissions. No public proof of concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild is known.

What to do: Update Modals to version 17.0.0 or later on all Joomla sites as soon as possible. Audit existing articles and modal destinations for executable URL schemes (e.g., javascript:, data:, vbscript:) and remove or sanitize any found. Restrict authoring and editing privileges to trusted users, since exploitation requires high privileges to plant the stored payload.