A stored Cross-site Scripting vulnerability in the Tabs & Accordions extension for Joomla allows authenticated attackers with administrative privileges to execute arbitrary JavaScript in the context of the application.

The extension fails to properly sanitize the data-rlta-alias attribute when injecting it into an onclick event handler. This flaw allows a privileged user to break out of the intended JavaScript context, leading to stored XSS.

Successful exploitation of this vulnerability allows an attacker with administrative access to perform unauthorized actions on behalf of other users or administrators. Given the CVSS score of 7.5, this high-severity flaw poses a risk of account takeover and potential compromise of the Joomla backend interface, which could lead to broader site defacement or unauthorized data access.

Immediate Action: Administrators should immediately restrict access to the affected extension settings and verify that no unauthorized scripts have been injected into existing tabs or accordion items.

Proactive Monitoring: Monitor site activity logs for unusual administrative actions or unexpected requests originating from the Joomla backend, specifically targeting extension configuration pages.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to filter suspicious patterns within the data-rlta-alias parameter, effectively blocking attempts to inject malicious scripts until a vendor patch is applied.

Public Exploit Available: Unknown

Given the high impact of this stored XSS vulnerability, administrators must prioritize the security of their Joomla extension environment. Monitor the vendor website for the release of version 3.1.0 or higher, and apply the update immediately upon availability to remediate this security gap.