CVE-2026-64795 is a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability in the regularlabs.com Modals extension for Joomla. The vulnerability involves XSS vectors in tag-provided inputs, including custom HTML, module content/title overrides, and decoded modal or tooltip values. These inputs are not properly sanitized, enabling a content author to inject malicious JavaScript that executes in the browsers of site visitors. The affected versions range from 1.0.0 through 15.0.0. No official patch or remediation level has been provided by the vendor as of the publication date. There are no known exploits in the wild.

Successful exploitation allows a content author to inject and execute arbitrary JavaScript in the browsers of visitors to the affected Joomla site. This can lead to information disclosure or manipulation of the user interface, but does not impact availability. The CVSS vector indicates low attack complexity, requires low privileges, and user interaction is required. The impact on confidentiality and integrity is low, with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict content author privileges to trusted users only and avoid using untrusted input in tag-provided custom HTML, module content/title overrides, or modal/tooltip values. Monitor official channels from regularlabs.com for updates or patches addressing this vulnerability.