High severity · published Sep 14, 2026
CVE-2026-85189
Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0 - Modals treats a destination using an executable browser URL scheme as an ordinary modal URL. The value can reach both the generated link and the iframe-loading path. Authored content can consequently become JavaScript in a visitor's browser without using Modals' separate Pro JavaScript Events feature.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MF
Modals (Free, Pro) extension for Joomla · regularlabs.com
4.0.0-16.2.0 · source: vendor
Affected product
MF
Modals (Free, Pro) extension for Joomla
regularlabs.com