The Tabs & Accordions Pro extension for Joomla versions 2.3.0 to 3.1.0 accepts a URL option for an item and writes it into a data-rlta-url attribute in the generated HTML. The browser later uses this attribute value in a call to window.open() when the item is activated. Because the extension does not reject JavaScript URL schemes, an attacker with privileges to author content can inject JavaScript code that executes in the context of the site, constituting a stored XSS vulnerability. Joomla's content filtering does not detect this because the plugin syntax appears ordinary during filtering, but the executable behavior is created later during rendering.

An attacker with privileges to author content in affected versions can inject malicious JavaScript that executes in users' browsers when they activate the affected Tabs & Accordions item. This can lead to privilege escalation, data theft, or other malicious actions within the context of the Joomla site. The vulnerability requires privileged access to exploit and does not involve user interaction beyond activating the item.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict content authoring privileges to trusted users and avoid using untrusted URLs in the Tabs & Accordions extension. Monitor vendor communications for updates and apply official patches once released.