CVE-2026-88853: Regularlabs.com Modals Pro Extension For Joomla

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0 - Modals Pro intentionally supports JavaScript Events such as on-open and on-closed. Affected versions do not distinguish trusted extension configuration from event code supplied in ordinary article content. A lower-privileged author can therefore use a documented executable feature which should be reserved for trusted authors.

Affected products

Published 2026-09-14. Last modified 2026-09-16.