CVE-2026-100751 in Tabs & Accordions (Pro) Extension
Summary
by MITRE • 09/28/2026
Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0 - Tabs & Accordions Pro accepts a url option for an item and writes it to a generated data-rlta-url attribute. The browser code passes that value to window.open() when the item is activated. Affected versions do not reject browser URL schemes which execute JavaScript. Joomla sees ordinary plugin syntax while filtering the authored article; Tabs & Accordions creates the executable browser behavior later while rendering the article.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified in regularlabs.com's Tabs and Accordions Pro extension for Joomla represents a critical security flaw rooted in improper input validation and unsafe DOM manipulation within client-side JavaScript execution contexts. This specific issue affects versions 2.3.0 through 3.1.0 of the software, where the application accepts user-supplied URLs as options for tab or accordion items. These values are directly written into HTML data attributes, specifically data-rlta-url, without adequate sanitization to prevent malicious payloads. The core technical failure lies in the extension's rendering logic, which takes these stored attribute values and passes them to the browser window.open() function when a user activates an item. This mechanism creates a direct pathway for Cross-Site Scripting attacks because the application fails to reject or sanitize dangerous URL schemes such as javascript: that can execute arbitrary code within the victim's browser context.
From a technical perspective, this vulnerability is classified under CWE-79, which covers Improper Neutralization of Input During Web Page Generation known commonly as Cross-site Scripting (XSS). More specifically, it aligns with CWE-80 due to the lack of proper validation on URL schemes before they are processed by browser-native functions. The attack vector relies on Stored XSS characteristics because the malicious payload is saved within the Joomla article content via standard plugin syntax. Unlike reflected XSS where the payload is delivered through a single request, this vulnerability persists in the database or file system until an administrator or authorized user views the affected page. When the victim interacts with the compromised tab or accordion element, the browser interprets the javascript: scheme as executable code rather than a navigational target, leading to immediate script execution within the context of the Joomla site.
The operational impact of this vulnerability is severe due to its privileged nature and stored persistence. Since Joomla administrators typically have elevated privileges, an attacker who can inject such payloads into articles accessible by admins could achieve full account compromise. This includes stealing session cookies, performing actions on behalf of the administrator, modifying website content, or redirecting users to phishing sites. The exploitation chain is particularly insidious because it bypasses server-side filtering mechanisms that Joomla employs for standard plugin syntax during article editing. The security control fails at the client side where the Tabs and Accordions Pro extension renders the data, creating a blind spot in traditional web application firewalls and input validation layers designed to catch malicious HTML or script tags directly embedded in content bodies rather than within attribute values processed by JavaScript libraries.
Mitigation strategies must address both immediate remediation and long-term defensive posture improvements. The most effective solution is for users of the affected versions 2.3.0 through 3.1.0 to upgrade immediately to a patched version where input validation has been strengthened to explicitly block javascript: URLs in data attributes. In cases where upgrading is not immediately feasible, administrators should implement strict content filtering rules that strip or encode dangerous URL schemes before they are stored in the database. Additionally, deploying Content Security Policy headers can help mitigate the impact by restricting script execution sources and preventing inline scripts from running even if injected via XSS vectors. Regular security audits of third-party extensions are essential to identify similar patterns where user input is passed directly to browser APIs without sufficient sanitization.
This vulnerability maps to MITRE ATT&CK technique T1059, specifically the JavaScript sub-technique, which describes how attackers use scripting languages to execute malicious commands within a victim's environment. It also relates to TA0003 Persistence and TA0005 Defense Evasion as stored XSS allows long-term access and bypasses standard input filters by hiding payloads in attribute values rather than visible text nodes. Understanding this attack pattern highlights the importance of validating not just the content but also the context in which that content is rendered, ensuring that dynamic data binding operations like window.open() are protected against scheme-based injection attacks.