The Modals extension for Joomla by regularlabs.com suffers from CWE-79, an improper neutralization of input vulnerability leading to cross-site scripting. Specifically, unsafe markup can be executed via tag-provided custom HTML, module content/title overrides, and decoded modal or tooltip values. This allows a content author to inject JavaScript that runs in the browsers of site visitors. The affected versions are from 1.0.0 up to and including 15.0.0. There is no CVSS score assigned, no vendor advisory or patch information available, and no known active exploitation reported.

Successful exploitation allows a content author to inject and execute arbitrary JavaScript in the browsers of visitors to the affected Joomla site. This can lead to typical XSS impacts such as session hijacking, defacement, or redirection to malicious sites. However, the vulnerability requires content author privileges to exploit, limiting the scope of impact to users with such access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict content author permissions to trusted users only and avoid using untrusted input in modals or tooltips. Monitor regularlabs.com and Joomla security advisories for updates on patches or mitigations.