Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-85190

Quick Index (Free, Pro) extension for Joomla · Vulnerability

CVSS 4.0 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-85190

Published

Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5 - Quick Index inserts configurable class values into generated HTML without escaping them for an HTML attribute. A crafted value can close the intended class attribute and introduce a new attribute. Joomla's content filter cannot reliably prevent this because Quick Index creates the executable HTML after the authored plugin syntax was filtered.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-85190

Published

plg_system_quickindex

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "packageName": "plg_system_quickindex",
                    "product": "Quick Index (Free, Pro) extension for Joomla",
                    "vendor": "regularlabs.com",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.0.0-5.0.4"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON