CVE-2026-85190: Joomla Quick Index XSS Vulnerability

CVE-2026-85190 Overview

CVE-2026-85190 is a stored cross-site scripting (XSS) vulnerability in the Quick Index extension by Regular Labs for Joomla versions prior to 5.0.5. The extension inserts configurable class option values into generated HTML without escaping them for an HTML attribute context. An authenticated user with privileged content permissions can craft a class value that closes the intended class attribute and injects a new attribute containing script content. Joomla's built-in content filter cannot block this payload because Quick Index generates the executable HTML after the authored plugin syntax has already been filtered. The flaw is tracked as CWE-79.

Critical Impact
A privileged Joomla author can inject persistent JavaScript into rendered pages, enabling session theft, administrative account takeover, and further compromise of the Joomla site.

Affected Products

Regular Labs Quick Index extension for Joomla, versions prior to 5.0.5
Joomla sites with the Quick Index plugin enabled
Content workflows relying on Joomla's default content filter for XSS protection

Discovery Timeline

2026-09-14 - CVE-2026-85190 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-85190

Vulnerability Analysis

Quick Index is a Joomla extension that automatically generates a table of contents or index block from headings within content. Administrators and authors can configure the CSS class applied to the generated markup through a plugin option. The extension writes this configured class value directly into an HTML class attribute in the rendered output.

Because the value is not escaped for the attribute context, an attacker who can set the class option can supply a payload that includes a closing quote followed by additional attributes. The browser parses the injected attribute as legitimate markup, executing any script defined by event handlers such as onmouseover or onerror. The payload is stored server-side and executes for every user who views the affected page.

Root Cause

The root cause is missing output encoding for HTML attribute context. Joomla's global content filter operates on the authored plugin syntax before Quick Index expands it into HTML, so filtered input is not the same string that ultimately reaches the browser. The extension trusts the class option and concatenates it into the output template without applying htmlspecialchars with ENT_QUOTES or an equivalent attribute-safe escape.

Attack Vector

Exploitation requires an authenticated Joomla account with permission to configure Quick Index or to set the class option on a content item that uses the plugin. The attacker submits a crafted class value that breaks out of the class="..." attribute and injects an event handler with JavaScript. When any visitor renders the affected page, the browser executes the injected script under the site's origin. This enables session cookie theft, forced actions against the Joomla administrator interface, and defacement or redirect chains against site visitors.

No verified public proof-of-concept code is available. Refer to the Regular Labs homepage for vendor updates and technical details.

Detection Methods for CVE-2026-85190

Indicators of Compromise

Quick Index plugin configuration entries containing quote characters, angle brackets, or HTML event handler names such as onerror, onload, or onmouseover in the class option field.
Rendered pages containing unexpected <script> fragments, inline event handlers, or malformed class attributes near Quick Index generated markup.
Outbound requests from user browsers to attacker-controlled domains shortly after loading pages that include Quick Index blocks.

Detection Strategies

Audit the Joomla #__extensions and content tables for Quick Index parameter values that contain characters outside a strict class-name allowlist such as [A-Za-z0-9_\- ].
Review web server access logs for POST requests to administrator/index.php that modify Quick Index parameters and correlate with subsequent GET requests returning suspicious response bodies.
Deploy Content Security Policy (CSP) reporting to capture inline script executions that would result from a successful injection.

Monitoring Recommendations

Alert on Joomla administrator logins from unusual IP addresses followed by plugin configuration changes.
Monitor for creation or modification of content items by accounts that do not typically author content.
Track HTTP responses for anomalous attribute patterns using web application firewall (WAF) inspection rules focused on Quick Index output.

How to Mitigate CVE-2026-85190

Immediate Actions Required

Update the Quick Index extension to version 5.0.5 or later on all Joomla installations.
Review all existing Quick Index configurations and content items for previously injected payloads and remove any that fail a strict class-name allowlist.
Rotate Joomla administrator and privileged author credentials if unexpected configuration changes are found.

Patch Information

Regular Labs addresses this vulnerability in Quick Index version 5.0.5. Administrators should download the fixed release from the Regular Labs website and apply it through the Joomla Extensions Manager. Verify the installed version under Extensions > Manage > Manage after upgrade.

Workarounds

Disable the Quick Index plugin until the patched version is installed.
Restrict the Joomla permissions that allow configuring Quick Index parameters to a minimal set of trusted administrators.
Deploy a WAF rule that blocks Quick Index parameter values containing quote characters, angle brackets, or on* event handler substrings.

bash

# Example WAF pattern (ModSecurity) to block suspicious Quick Index class values
SecRule ARGS_NAMES "@rx quickindex.*class" \
    "phase:2,deny,status:403,id:1026085190,\
    msg:'Potential CVE-2026-85190 Quick Index XSS payload',\
    chain"
    SecRule ARGS "@rx [\"'<>]|on[a-z]+\s*=" "t:none,t:lowercase"