CyberRota Analysis
AI-GeneratedThe Tabs & Accordions extension for Joomla versions prior to 3.1.0 is vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of the rtla-alias option, allowing attackers to inject malicious JavaScript into the HTML onclick attribute. This vulnerability can lead to unauthorized actions being executed in the context of an affected user's session, potentially compromising sensitive information. Joomla administrators and users of the Tabs & Accordions extension should prioritize patching to mitigate the risk of exploitation.
Original NVD Description
Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0 - Tabs & Accordions rewrites links matching an item alias into calls to its browser API. The affected renderer places the alias inside a quoted JavaScript argument in an HTML onclick attribute without securing both the JavaScript-string and HTML-attribute contexts. A crafted data-rlta-alias value can therefore change the generated handler.