Stored XSS Vulnerability in Joomla Extension by Regular Labs

CVE-2026-100751

What is CVE-2026-100751?

The Tabs & Accordions Pro extension by Regular Labs is vulnerable to a stored XSS attack through the data-rlta-url attribute. When a URL option is added for an item, it is passed to a generated data-rlta-url attribute. This behavior allows potential attackers to inject malicious JavaScript that can execute when users interact with the element, exploiting the functionality of the extension without proper URL scheme filtering. It is crucial for users of affected versions to update and secure their installations to prevent possible exploitation.

References