CVE-2026-85189 Overview
CVE-2026-85189 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Modals extension for Joomla developed by Regular Labs. Versions prior to 17.0.0 treat destinations containing executable browser URL schemes as ordinary modal URLs. The unsanitized value reaches both the generated link and the iframe-loading path. Authored content can therefore execute JavaScript in a visitor's browser without requiring the separate Pro JavaScript Events feature. Exploitation requires privileged content-authoring access, but the payload executes in the context of any visitor who interacts with the affected modal.
Critical Impact
A privileged content author can store executable JavaScript in a modal destination, causing arbitrary script execution in visitor browsers viewing the affected page.
Affected Products
- Regular Labs Modals extension for Joomla, versions prior to 17.0.0
- Joomla content management system instances with the vulnerable extension installed
- Sites permitting content authoring by non-super-admin users
Discovery Timeline
- 2026-09-14 - CVE-2026-85189 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-85189
Vulnerability Analysis
The Modals extension renders user-supplied destination values into two distinct sinks: the generated anchor href attribute and an iframe source used to load the modal content. Both sinks accept the destination string without validating the URL scheme. When a content author supplies a value using an executable browser scheme such as javascript:, the extension emits the payload verbatim into the rendered markup.
When a site visitor interacts with the modal trigger, the browser evaluates the scheme and executes the attacker-supplied JavaScript in the origin of the Joomla site. This bypasses the extension's Pro JavaScript Events feature, which is normally the gated pathway for author-supplied script logic. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Root Cause
The root cause is missing scheme allowlisting on the modal destination parameter. The extension accepts any string as a URL and passes it through to HTML generation without restricting protocols to safe values such as http, https, or mailto. Because the value is written to both a link target and an iframe loader, sanitization must apply to both output contexts.
Attack Vector
An authenticated user with content-authoring privileges creates or edits Joomla content containing a Modals shortcode or module configured with a destination beginning with an executable scheme. The stored payload is served to any visitor rendering the affected page. When the visitor clicks the modal link or the iframe loads, the browser executes the attacker's script in the site's origin. Consequences include session token theft, forced administrative actions via CSRF, defacement, and delivery of secondary payloads.
No verified proof-of-concept code is publicly available. Refer to the Regular Labs Official Site for vendor guidance and version details.
Detection Methods for CVE-2026-85189
Indicators of Compromise
- Modals shortcode or module parameters containing destination values that begin with javascript:, data:, or vbscript: schemes
- Rendered HTML output where href or iframe src attributes emitted by Modals contain non-http(s) schemes
- Outbound requests from visitor browsers to unexpected domains coinciding with pages that embed Modals content
Detection Strategies
- Query the Joomla content database for stored Modals configurations and filter destination fields against an allowlist of safe URL schemes
- Deploy web application firewall rules to inspect POST bodies submitted to Joomla content endpoints for suspicious scheme prefixes in Modals parameters
- Enable Content Security Policy (CSP) reporting to surface inline script execution originating from anchor navigation or iframe loads
Monitoring Recommendations
- Audit Joomla user accounts with content-authoring privileges and review recent edits to articles, modules, and custom HTML containing Modals references
- Log and alert on new or modified Modals instances submitted by non-administrative users
- Monitor web server access logs for unusual referrer patterns or credential-theft callbacks tied to pages using the Modals extension
How to Mitigate CVE-2026-85189
Immediate Actions Required
- Upgrade the Regular Labs Modals extension for Joomla to version 17.0.0 or later on all affected sites
- Inventory Joomla installations to identify sites running vulnerable Modals versions and prioritize public-facing properties
- Review all existing Modals configurations for destination values using executable URL schemes and remove or replace them
Patch Information
Regular Labs has addressed the vulnerability in Modals version 17.0.0. Administrators should download the fixed release from the Regular Labs Official Site and apply it through the Joomla Extensions Manager. Verify the installed version after upgrade using the Joomla administrator interface.
Workarounds
- Restrict content-authoring privileges to trusted users until the extension is upgraded
- Deploy a strict Content Security Policy that disallows inline script execution and restricts iframe sources to trusted origins
- Temporarily disable the Modals extension on sites where immediate patching is not feasible
- Apply a web application firewall rule blocking submissions containing javascript: or data: schemes in Joomla content parameters
# Example Content-Security-Policy header to limit script execution contexts
Content-Security-Policy: default-src 'self'; script-src 'self'; frame-src 'self' https://trusted-embed.example.com; object-src 'none'; base-uri 'self'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
