A stored cross‑site scripting flaw exists in the Tabs & Accordions Pro extension for Joomla. The component accepts a URL option for an item and writes it directly into a data‑rlta‑url attribute. When the item is activated the browser passes that value to window.open(). The affected versions do not reject JavaScript URL schemes, so an attacker who can insert a URL value can cause the browser to execute arbitrary JavaScript in the context of the Joomla site. The flaw is a typical example of CWE‑79, where user input is incorporated into the page without proper sanitization, leading to a potential compromise of confidentiality, integrity, or availability depending on the victim’s level of access. Even though Joomla performs ordinary plugin syntax filtering during article creation, the attribute is rendered later, allowing the injected code to reach the browser.

The issue affects the "Tabs & Accordions" extension (both Free and Pro) for Joomla, produced by regularlabs.com. The vulnerability is present in the Pro version for all releases from 2.3.0 up to and including 3.1.0. Users running any of those versions are at risk.

The CVSS base score of 7.5 indicates a high impact potential, while the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker with privileges to author or edit content within Joomla, where they can supply a crafted URL value. Once the data‑rlta‑url attribute is rendered, the browser will execute the payload via window.open(), providing non‑privileged users with the same level of influence as the authoring user. Given the lack of automatic user‑agent filtering for JavaScript schemes, exploitation is straightforward for an attacker who can insert the payload.