CVE-2026-65756 is a CWE-79 cross-site scripting vulnerability in the Keyboard Shortcuts extension for Joomla by regularlabs.com. The vulnerability arises because the shortcut configuration functionality accepts arbitrary inline JavaScript without proper input neutralization, allowing injection of malicious scripts. This affects all versions from 1.0.0 up to and including 3.2.5. No CVSS score or vendor advisory is currently available, and no patch or mitigation has been published.

An attacker could exploit this vulnerability to inject and execute arbitrary JavaScript in the context of the affected Joomla site, potentially leading to session hijacking, defacement, or other malicious actions depending on the victim's privileges and browser context. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Keyboard Shortcuts extension or restricting its use to trusted administrators only to reduce exposure.