September 20, 2026

CVE Watchtower

← Back to CVE List

CVE-2026-85189NVD

Description

Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0 - Modals treats a destination using an executable browser URL scheme as an ordinary modal URL. The value can reach both the generated link and the iframe-loading path. Authored content can consequently become JavaScript in a visitor's browser without using Modals' separate Pro JavaScript Events feature.
Severity Level
UNKNOWN
Published Date
14/09/2026
Last Modified
15/09/2026
Exploitation Status
????
EPSS Score
0.25% (percentile 16.3%)

CVSS Base Metrics

CVSS v4 (4.0)
HIGH 7.5
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/S:N/AU:N

Weaknesses (CWE)

CWE-79 - CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected & Patched Versions

ProductAffected VersionsPatched Version
regularlabs.com Modals (Free, Pro) extension for Joomla4.0.0-16.2.0N/A
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
⚙️Custom EPSS — Filter noise, focus on risk.
💬Webhooks — Slack & Teams integration.
🚫Ad-Free — Uninterrupted experience.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
⚙️Custom EPSS — Filter noise, focus on risk.
💬Webhooks — Slack & Teams integration.
🚫Ad-Free — Uninterrupted experience.

References