CVE-2026-88853

Regular Labs Modals Pro for Joomla, in all versions before 17.0.0, contains a privileged stored cross-site scripting (XSS) flaw because its documented JavaScript event-handler feature (such as on-open and on-closed) is not restricted to trusted extension configuration. An authenticated attacker holding only author-level privileges can embed executable event code in ordinary article content, and that script then runs in the browser of any user — including a site administrator — who views the page. Successful exploitation gives the attacker script execution in a higher-privileged user's session, which can be leveraged for administrative actions such as content tampering, further account compromise, or site takeover. Sites running Modals Pro below 17.0.0 that allow non-trusted users to author articles are the most exposed; only the third-party extension is affected, not Joomla core. There is no evidence of exploitation in the wild, no public proof of concept, and the CVE is not on CISA's Known Exploited Vulnerabilities catalog.

What to do: Upgrade Modals Pro to version 17.0.0 or later, where the event-handler feature is reserved for trusted extension configuration. Until then, restrict article authoring to fully trusted staff and review existing articles for {modal} tags containing on-open/on-closed or other event attributes from untrusted contributors. Also audit author-level user accounts for suspicious or unauthorized registrations, since the flaw requires an authenticated author account to exploit.