High severity · published Sep 14, 2026
CVE-2026-85190
Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5 - Quick Index inserts configurable class values into generated HTML without escaping them for an HTML attribute. A crafted value can close the intended class attribute and introduce a new attribute. Joomla's content filter cannot reliably prevent this because Quick Index creates the executable HTML after the authored plugin syntax was filtered.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QI
Quick Index (Free, Pro) extension for Joomla · regularlabs.com
1.0.0-5.0.4 · source: vendor
Affected product
QI
Quick Index (Free, Pro) extension for Joomla
regularlabs.com