CVE-2026-85191

Tabs & Accordions, a Joomla extension from Regular Labs (regularlabs.com), contains a stored cross-site scripting (XSS) flaw in all versions before 3.1.0: the extension rewrites links matching an item alias into calls to its browser API and places that alias inside a quoted JavaScript argument within an HTML onclick attribute, without escaping either the JavaScript-string or the HTML-attribute context. An attacker with the privileged access needed to set the rtla-alias option (for example, a backend user permitted to edit the extension's items or relevant content) can supply a crafted data-rlta-alias value that alters the generated click handler and executes attacker-controlled JavaScript. Because the payload is stored and fires with no victim interaction, it can target higher-privileged users such as site administrators, enabling session theft and full site takeover (CVSS 4.0: 7.5, high). Affected deployments are Joomla sites running Tabs & Accordions earlier than 3.1.0, particularly those where semi-trusted users hold content- or extension-editing rights. The flaw is not in CISA's KEV catalog, and no public proof of concept or observed in-the-wild exploitation is known.

What to do: Upgrade Tabs & Accordions to version 3.1.0 or later, which remediates the flaw. Audit existing articles and extension items for suspicious data-rlta-alias values or unexpected onclick handlers, and restrict which backend accounts are allowed to edit those items. If tampering is found, remove the injected content and reset administrator sessions and credentials.