The Modals extension for Joomla versions 4.0.0 through 16.2.0 improperly neutralizes input during web page generation, specifically by treating destination URLs using executable browser schemes as ordinary modal URLs. This flaw allows privileged stored cross-site scripting (CWE-79) where authored content containing such URLs can be rendered as JavaScript in a visitor's browser. The vulnerability does not require the use of the Pro JavaScript Events feature to exploit, increasing its risk profile. The CVSS 4.0 score is 7.5, indicating high severity with network attack vector, low attack complexity, and partial privileges required.

Successful exploitation allows an attacker with privileged access to inject malicious JavaScript that executes in the context of visitors' browsers. This can lead to unauthorized actions performed on behalf of users, data theft, or session hijacking. The vulnerability affects confidentiality, integrity, and availability components with high impact on confidentiality and integrity and low impact on availability.

No official patch or remediation guidance is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted or executable URL schemes in modal destinations and restrict privileged user input where possible.