Medium severity · published Sep 28, 2026
CVE-2026-100751
Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0 - Tabs & Accordions Pro accepts a url option for an item and writes it to a generated data-rlta-url attribute. The browser code passes that value to window.open() when the item is activated. Affected versions do not reject browser URL schemes which execute JavaScript. Joomla sees ordinary plugin syntax while filtering the authored article; Tabs & Accordions creates the executable browser behavior later while rendering the article.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
Tabs & Accordions (Free, Pro) extension for Joomla · regularlabs.com
2.3.0-3.1.0 · source: vendor
TA
Tabs & Accordions · Regularlabs
2.3.0 through 3.1.0 · source: NVD
Affected product
TA
Tabs & Accordions (Free, Pro) extension for Joomla
regularlabs.com
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100751
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100751
product
https://www.regularlabs.com/
More from Tabs & Accordions (Free, Pro) extension for Joomla
7.5
CVE-2026-85191
Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0