CVE-2026-88853

Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0 - Modals Pro intentionally supports JavaScript Events such as on-open and on-closed. Affected versions do not distinguish trusted extension configuration from event code supplied in ordinary article content. A lower-privileged author can therefore use a documented executable feature which should be reserved for trusted authors.

• CWE-79

• https://www.regularlabs.com/

Published

Sep 14, 2026

Last Modified

Sep 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88845The MasterStudy LMS WordPress Plugin WordPress plugin befor…4.3
• CVE-2026-88846The MasterStudy LMS WordPress Plugin WordPress plugin befor…5.3
• CVE-2026-88847The MasterStudy LMS WordPress Plugin WordPress plugin befor…4.3
• CVE-2026-88848The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 …4.2
• CVE-2026-8885The DeMomentSomTres Shortcodes plugin for WordPress is vulne…6.4
• CVE-2026-88852Joomla Extension - regularlabs.com - Privileged stored XSS v…7.5
• CVE-2026-88854Joomla Extension - OrdaSoft.com - Unauthenticated SQL Inject…9.3
• CVE-2026-88855Joomla Extension - OrdaSoft.com - Authenticated, Privileged …8.6
• CVE-2026-88856Joomla Extension - OrdaSoft.com - Authenticated, Privileged …9.4
• CVE-2026-88857Joomla Extension - OrdaSoft.com - Authenticated, Privileged …9.4
• CVE-2026-88859A flaw was found in Evolution. A remote attacker can exploit…6.3
• CVE-2026-8886The hk_shortcode plugin for WordPress is vulnerable to Store…6.4