A stored cross-site scripting vulnerability in the Regular Labs Modals extension for Joomla allows authenticated privileged users to execute arbitrary JavaScript in the context of a visitor's browser.

This vulnerability is a stored cross-site scripting (CWE-79) flaw triggered when the extension fails to properly neutralize URL schemes. An authenticated user with administrative privileges can inject malicious payloads that execute when a visitor interacts with the affected modal content.

The ability for an attacker to execute arbitrary JavaScript in the browser of site visitors presents a significant risk of session hijacking, unauthorized actions performed on behalf of users, and the potential theft of sensitive session cookies. Given the CVSS score of 7.5, this high-severity flaw could lead to full site compromise if administrative sessions are targeted, resulting in severe reputational damage and loss of user trust.

Immediate Action: Update the Regular Labs Modals extension to version 17.0.0 or later immediately upon release by the vendor.

Proactive Monitoring: Review web server access logs for unusual input patterns in URL parameters associated with the Modals extension and monitor for unexpected JavaScript execution or unauthorized redirects.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the sources from which scripts can be loaded and executed, which can significantly mitigate the impact of XSS vulnerabilities.

Public Exploit Available: No

This vulnerability represents a high-risk entry point for malicious activity within the Joomla environment. Administrators should verify their current version of the Modals extension and prioritize the installation of the security update as soon as it becomes available to prevent potential exploitation of site visitors.