Stored XSS Vulnerability in Quick Index Extension for Joomla by Regular Labs

CVE-2026-85190

What is CVE-2026-85190?

A stored cross-site scripting (XSS) vulnerability exists in the Quick Index extension for Joomla. This issue arises when the extension inserts unescaped configurable class values into the generated HTML. As a result, a crafted class attribute can terminate the original class definition and insert malicious attributes. The Joomla content filter fails to prevent such exploitation because the Quick Index processes the HTML code post-filtering of its plugin syntax, leaving room for potential attacks.

References