CVE-2026-100751 Overview
CVE-2026-100751 is a stored cross-site scripting (XSS) vulnerability in the Regular Labs Tabs & Accordions Pro extension for Joomla, versions 2.3.0 through 3.1.0. The extension accepts a url option for tab or accordion items and writes it into a generated data-rlta-url attribute. When a user activates the item, the browser passes that attribute value to window.open(). Affected versions fail to reject browser URL schemes that execute JavaScript, allowing attackers with authoring privileges to inject executable payloads. Joomla sanitizes the article content before the extension generates the executable attribute, so the filter never sees the final payload.
Critical Impact
Authenticated users with content authoring rights can store JavaScript that executes in the browsers of visitors who interact with the affected tab or accordion item.
Affected Products
- Regular Labs Tabs & Accordions Pro 2.3.0 through 3.1.0
- Joomla sites rendering articles that include the Tabs & Accordions plugin syntax
- Browsers rendering data-rlta-url attributes produced by the vulnerable extension
Discovery Timeline
- 2026-09-28 - CVE-2026-100751 published to the National Vulnerability Database
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-100751
Vulnerability Analysis
The flaw is a classic stored XSS pattern [CWE-79] produced by a split between sanitization and rendering stages. An author writes a Tabs & Accordions plugin tag inside an article and supplies a url option. Joomla's content filter inspects the raw article text, sees ordinary plugin syntax, and allows it. Later, the Regular Labs extension processes the plugin tag and emits HTML containing a data-rlta-url attribute populated with the author-supplied value. Client-side JavaScript shipped with the extension reads that attribute and calls window.open() with the value when a visitor activates the tab or accordion. Because the extension does not restrict permitted URL schemes, values such as javascript: reach window.open() and execute in the context of the viewing user. The attack requires authoring privileges but no interaction from the victim beyond opening the tab.
Root Cause
The extension performs no scheme allowlisting on the url option before writing it to data-rlta-url and before passing it to window.open(). Joomla's upstream HTML filtering does not inspect attributes that the extension generates after filtering completes, so dangerous schemes propagate unmodified from storage to execution.
Attack Vector
An authenticated contributor, author, editor, or publisher inserts a Tabs & Accordions Pro plugin tag containing a url option that uses a JavaScript URL scheme. The payload is saved to the article record. When any visitor renders the article and activates the targeted item, the browser invokes window.open() on the attacker-controlled value and executes the embedded script in the site's origin. The vulnerability is reachable over the network and requires no victim interaction beyond normal article browsing.
No verified proof-of-concept code is available at this time. See the Regular Labs website for vendor information.
Detection Methods for CVE-2026-100751
Indicators of Compromise
- Rendered article HTML containing data-rlta-url attributes whose values begin with javascript:, data:, or vbscript:
- Stored article content with Tabs & Accordions plugin tags containing suspicious url= option values
- Unexpected outbound requests or script execution originating from tab or accordion activation
Detection Strategies
- Query the Joomla #__content table for plugin syntax that assigns non-http/https schemes to the url option
- Scan rendered page output for data-rlta-url attributes with disallowed schemes using a crawler or static HTML inspection
- Review web server access logs for article edits followed by activity from unprivileged visitor sessions targeting the modified articles
Monitoring Recommendations
- Alert on content submissions by lower-privileged authors that include Regular Labs plugin tags with url options
- Monitor Content Security Policy violation reports for inline script execution on article pages
- Track installed extension versions and flag any Tabs & Accordions Pro installation between 2.3.0 and 3.1.0
How to Mitigate CVE-2026-100751
Immediate Actions Required
- Upgrade Tabs & Accordions Pro to a release later than 3.1.0 once Regular Labs publishes a fixed version
- Audit existing articles for Tabs & Accordions plugin syntax containing non-standard URL schemes and remove or sanitize them
- Restrict article authoring privileges to trusted accounts and review recent content submissions from lower-tier roles
Patch Information
Regular Labs distributes updates through its subscriber download portal. Refer to the Regular Labs website for the current fixed release and extension changelog. Apply the patched version through the Joomla extension manager and clear any cached rendered output after upgrade.
Workarounds
- Disable the Tabs & Accordions Pro plugin until a fixed version is installed
- Deploy a Content Security Policy that forbids inline script execution and restricts javascript: URLs on article pages
- Add a web application firewall rule that blocks article save requests containing url="javascript: or similar payloads within Regular Labs plugin tags
# Example Content-Security-Policy header to limit script execution
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
