CVE-2026-85191 Cross-site scripting in Tabs & Accordions (Free, Pro) extension for Joomla
Privileged stored XSS in Joomla Tabs & Accordions extension allows attackers to inject scripts via crafted alias values, potentially leading to session hijacking or code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85191?
CVE-2026-85191 is a high-severity cross-site scripting vulnerability in regularlabs.com Tabs & Accordions (Free, Pro) extension for Joomla, published on 14 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0 - Tabs & Accordions rewrites links matching an item alias into calls to its browser API. The affected renderer places the alias inside a quoted JavaScript argument in an HTML onclick attribute without securing both the JavaScript-string and HTML-attribute contexts. A crafted data-rlta-alias value can therefore change the generated handler.
Weakness: CWE-79
Which versions are affected by CVE-2026-85191?
How do I fix CVE-2026-85191?
No fix has been published for CVE-2026-85191 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-85191 being exploited?
There is no known exploitation of CVE-2026-85191 in the wild and no public exploit code.
Sources
Also known as GHSA-72vc-r8gq-9v5v.