CVE-2026-64795
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
XSS vectors in tag-provided inputs in various Regular Labs extensions for Joomla allow tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values to execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers.
Risk Assessment
An attacker can inject malicious scripts that execute in users' browsers, potentially leading to session theft, redirects, or other attacks.
Recommendation
Update all Regular Labs extensions to the latest versions that fix this XSS vulnerability.
Other vulnerabilities in Regular Labs extensions
See all- CVE-2026-64792High
Multiple Regular Labs extensions for Joomla! disclose restricted content via the Smart Search index: indexing can render generated content using the indexing administrator's identity instead of a public guest, causing restricted or administrator-only content to be stored in the public search index.
- CVE-2026-63684High
Multiple Regular Labs extensions for Joomla did not consistently check CSRF tokens, item permissions, or input validation in admin actions, editor popups, and import/export operations. Unauthorized backend users or CSRF attacks could expose, create, or modify extension configuration and items.
- CVE-2026-63265High
AJAX endpoints in various Regular Labs extensions for Joomla did not consistently require valid CSRF tokens, matching component/item permissions, or trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization.
Original NVD description (English source)
Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers.