The Modals Pro extension for Joomla is vulnerable to stored XSS, allowing authorized authors to execute malicious scripts due to insufficient input validation.

This is a stored XSS vulnerability (CWE-79) where the extension fails to differentiate between trusted configuration and user-supplied content in JavaScript events like on-open and on-closed. While the CVSS score is 7.5, the vulnerability requires high privileges, meaning an attacker must already be an authenticated author to trigger the malicious payload.

An authenticated author can exploit this flaw to execute arbitrary JavaScript in the context of other users, including administrators. This could lead to account takeover, unauthorized data access, or administrative actions performed on behalf of the victim, significantly damaging the integrity and security of the Joomla installation.

Immediate Action: Upgrade the Modals Pro extension to version 17.0.0 or later as soon as possible.

Proactive Monitoring: Review audit logs for suspicious activity involving article creation or modification, particularly those containing JavaScript event handlers.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and limit the potential impact of XSS on the platform.

Public Exploit Available: No

Administrators should treat this vulnerability with high priority by ensuring all extensions are updated to the latest secure version. Restricting authoring permissions to trusted personnel is also recommended until the patch is applied.