CVE-2026-85191: Joomla Tabs & Accordions XSS Vulnerability

CVE-2026-85191 Overview

CVE-2026-85191 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the Regular Labs Tabs & Accordions extension for Joomla, affecting versions prior to 3.1.0. The extension rewrites links matching an item alias into calls to its browser API. The affected renderer places the alias inside a quoted JavaScript argument within an HTML onclick attribute without securing both the JavaScript-string and HTML-attribute contexts. A crafted data-rlta-alias value can change the generated handler and execute attacker-controlled script in the browsers of users viewing the affected content.

Critical Impact
A privileged Joomla user can inject persistent JavaScript that executes in the sessions of other users, including administrators, enabling account takeover and further compromise of the Joomla site.

Affected Products

Regular Labs Tabs & Accordions extension for Joomla
All versions prior to 3.1.0
Joomla sites rendering content processed by the Tabs & Accordions plugin

Discovery Timeline

2026-09-14 - CVE-2026-85191 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-85191

Vulnerability Analysis

The Tabs & Accordions extension transforms links referencing item aliases into JavaScript handler invocations against its internal browser API. During rendering, the plugin embeds the alias value as an argument to a JavaScript function call placed inside an HTML onclick attribute. This creates two nested parsing contexts: the outer HTML attribute and the inner JavaScript string literal. The renderer fails to encode the alias for both contexts simultaneously.

Because the payload travels through the data-rlta-alias attribute and is stored in Joomla content, the injection is persistent. Any visitor that loads the page containing the modified tab or accordion item triggers the attacker-controlled handler.

Root Cause

The root cause is improper output encoding in a dual-context sink. The renderer treats the alias as a single-context value and applies escaping suitable for either JavaScript strings or HTML attributes, but not both. A crafted alias that breaks out of the JavaScript string can also break out of the HTML attribute, allowing arbitrary event-handler content or additional attributes.

Attack Vector

Exploitation requires an authenticated user with sufficient privileges to create or edit Joomla content that flows through Tabs & Accordions. The attacker crafts a data-rlta-alias value containing quote characters and JavaScript payload fragments. When another user renders the tab or accordion, the browser parses the modified onclick handler and executes attacker-controlled script under the target's origin, enabling session hijacking, privileged action forgery, and content manipulation.

No verified proof-of-concept has been published. See the Regular Labs Official Website for vendor guidance.

Detection Methods for CVE-2026-85191

Indicators of Compromise

Joomla content items or tab/accordion aliases containing quote characters, angle brackets, backslashes, or JavaScript keywords such as alert, eval, or fetch.
Unexpected outbound requests originating from administrator browsers immediately after loading pages that use Tabs & Accordions.
Newly created Joomla super-user accounts or unexplained changes to user permissions following administrator sessions.

Detection Strategies

Audit stored Joomla content and extension configuration tables for data-rlta-alias values that deviate from expected alphanumeric alias patterns.
Deploy server-side content-security scanning to flag alias fields containing HTML or JavaScript metacharacters.
Enable a strict Content Security Policy (CSP) and monitor report-uri or report-to violations for inline event-handler executions.

Monitoring Recommendations

Log all edits to Joomla content and extension parameters performed by privileged accounts, and review anomalous alias modifications.
Correlate web server access logs with administrator login sessions to identify unusual navigation patterns that may indicate XSS-driven actions.
Monitor browser telemetry from administrator workstations for suspicious script execution on Joomla admin pages.

How to Mitigate CVE-2026-85191

Immediate Actions Required

Upgrade the Regular Labs Tabs & Accordions extension to version 3.1.0 or later on every Joomla site where it is installed.
Review recent content revisions for suspicious data-rlta-alias values and revert any that contain scripting metacharacters.
Rotate credentials and invalidate active sessions for administrator accounts that may have loaded affected pages.

Patch Information

Regular Labs addressed the flaw in Tabs & Accordions version 3.1.0. Obtain the update from the vendor via the Regular Labs Official Website and apply it through the Joomla Extensions Manager.

Workarounds

Restrict Joomla content-editing privileges to trusted accounts until the extension is updated.
Enforce a strict CSP that disallows inline event handlers (script-src without 'unsafe-inline') to blunt exploitation of the injected onclick payload.
Temporarily disable the Tabs & Accordions plugin on high-value sites where immediate patching is not feasible.

bash

# Example Joomla CLI update workflow (adapt paths to your environment)
cd /path/to/joomla
php cli/joomla.php extension:update --name="Tabs and Accordions"
php cli/joomla.php extension:list | grep -i tabs