Regular Labs extensions vulnerabilities

XSS vectors in tag-provided inputs in various Regular Labs extensions for Joomla allow tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values to execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers.

Multiple Regular Labs extensions for Joomla! disclose restricted content via the Smart Search index: indexing can render generated content using the indexing administrator's identity instead of a public guest, causing restricted or administrator-only content to be stored in the public search index.

Multiple Regular Labs extensions for Joomla did not consistently check CSRF tokens, item permissions, or input validation in admin actions, editor popups, and import/export operations. Unauthorized backend users or CSRF attacks could expose, create, or modify extension configuration and items.

AJAX endpoints in various Regular Labs extensions for Joomla did not consistently require valid CSRF tokens, matching component/item permissions, or trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization.