CVE-2026-88853: Joomla Modals Pro Stored XSS Vulnerability

CVE-2026-88853 Overview

CVE-2026-88853 is a privileged stored cross-site scripting (XSS) vulnerability affecting the Modals Pro extension for Joomla developed by Regular Labs. The flaw exists in versions prior to 17.0.0 and stems from the extension's handling of JavaScript event handler options such as on-open and on-closed. Modals Pro intentionally supports these executable events for trusted configuration, but affected versions do not distinguish trusted extension configuration from event code supplied through ordinary article content. A lower-privileged author can therefore invoke a documented executable feature that should be reserved for trusted authors, resulting in stored script execution in the context of other users' sessions.

Critical Impact
Authenticated lower-privileged authors can inject persistent JavaScript that executes in the browsers of administrators and site visitors, enabling session theft and site takeover.

Affected Products

Regular Labs Modals Pro extension for Joomla, versions prior to 17.0.0
Joomla sites permitting content authoring by lower-privileged accounts
Any Joomla deployment where Modals Pro shortcodes are rendered in article content

Discovery Timeline

2026-09-14 - CVE-2026-88853 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-88853

Vulnerability Analysis

The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Modals Pro exposes modal dialog configuration options that can attach JavaScript to lifecycle events, including on-open and on-closed. These options are executed as script when the modal is rendered in a page.

In versions prior to 17.0.0, the extension applies the same execution semantics to event handler values regardless of whether they originate from a trusted extension configuration surface or from user-supplied article content. Content submitted by lower-privileged authors is parsed and rendered without stripping or sandboxing the executable event attributes, converting a documented feature into a stored XSS primitive.

Root Cause

The root cause is missing privilege differentiation during shortcode parsing. The extension trusts event handler parameters embedded in article content as if they were authored by a trusted administrator. There is no author-role check, allowlist filter, or output encoding applied to the on-open and on-closed values before they are emitted into the rendered page's script context.

Attack Vector

An attacker with author-level Joomla permissions creates or edits an article containing a Modals Pro shortcode. The attacker sets an event handler option such as on-open to arbitrary JavaScript. When any user, including administrators, loads the affected page and triggers the modal, the injected script executes with the victim's browser session. This enables session cookie theft, administrative action forgery, and pivoting to full site compromise.

The vulnerability requires network access and existing authenticated privileges but no user interaction beyond normal browsing of published content. See the Regular Labs Homepage for vendor product information.

Detection Methods for CVE-2026-88853

Indicators of Compromise

Article records in the Joomla #__content table containing Modals Pro shortcodes with on-open, on-closed, or similar event attributes carrying JavaScript payloads.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing content pages.
New Joomla Super User accounts, modified user group assignments, or plugin uploads that correlate with administrator sessions viewing author-created content.

Detection Strategies

Query the Joomla content database for shortcode patterns referencing Modals Pro event handlers and inspect the associated values for script content.
Deploy Content Security Policy (CSP) reporting to surface inline script executions originating from article rendering contexts.
Review author account activity for accounts that recently created or edited articles containing modal shortcodes.

Monitoring Recommendations

Log and alert on administrative actions (user creation, role changes, extension installs) performed within short intervals of content page views.
Monitor web server access logs for anomalous request patterns from administrator IP addresses following article rendering.
Track changes to Modals Pro configuration files and article revision histories for unauthorized modifications.

How to Mitigate CVE-2026-88853

Immediate Actions Required

Upgrade the Regular Labs Modals Pro extension to version 17.0.0 or later on all Joomla installations.
Audit existing article content for Modals Pro shortcodes containing on-open, on-closed, or other event handler options and remove untrusted entries.
Review recent author account registrations and revoke any accounts that cannot be attributed to legitimate contributors.

Patch Information

Regular Labs addressed the issue in Modals Pro version 17.0.0. The patched release enforces privilege separation for event handler options, ensuring executable event code is only honored when supplied through trusted extension configuration surfaces rather than article content authored by lower-privileged users. Refer to the Regular Labs Homepage for the current release and upgrade instructions.

Workarounds

Restrict article authoring privileges to trusted accounts until the upgrade to 17.0.0 is complete.
Disable or unpublish the Modals Pro plugin temporarily if immediate patching is not feasible.
Implement a strict Content Security Policy that blocks inline event handlers to reduce the impact of stored XSS payloads.

bash

# Verify installed Modals Pro version on the Joomla server
grep -i "version" /path/to/joomla/administrator/components/com_modals/modals.xml

# Search article content for suspicious event handler shortcodes
mysql -u joomla_user -p joomla_db -e \
  "SELECT id, title FROM jos_content WHERE introtext LIKE '%on-open=%' OR fulltext LIKE '%on-closed=%';"