Stored XSS Vulnerability in Modals Pro Extension for Joomla by Regular Labs

CVE-2026-88853

What is CVE-2026-88853?

The Modals Pro extension for Joomla allows for a privileged stored XSS attack through its event handler options. This vulnerability arises because the extension does not adequately distinguish between trusted extension configurations and event code supplied in ordinary article content. As a result, a lower-privileged author can exploit a feature that should be limited to trusted authors, potentially leading to unauthorized script execution within the user’s environment.

References