Modules Anywhere 10.0.0 and Tabs & Accordions 3.2.0 Close Two Content Author Security Holes

Regular Labs released Modules Anywhere 10.0.0 and Tabs & Accordions 3.2.0 for Joomla on 27 September 2026, and each has a [SECURITY FIX] entry in its changelog. Both close a way for someone with permission to write content to reach further than their role should allow: in Modules Anywhere, by changing the settings of any module they embed; in Tabs & Accordions, by placing JavaScript in a tab that runs in a visitor’s browser.

These are Joomla extension fixes, not Joomla core. Regular Labs found and fixed them; we did not report them, and the vendor credits no one.

Update, 28 September 2026: CVE-2026-100750 and CVE-2026-100751

The Joomla CNA has published both issues, and the records are wider than the changelog suggested.

This changes what we wrote on release day. The Modules Anywhere issue reaches the server itself: Joomla’s own Feed module opens its feed URL server-side and accepts local file: URLs, so an author who can override that setting can read files from the site’s server or make it request other addresses. Every Modules Anywhere Pro release back to 1.5.0 is affected, so the 7.x Joomla 3 branch and the 8.x releases are in range alongside 9.x. Tabs & Accordions Free is affected as well as Pro.

We have widened our flags to match. A day after release, 41% of the Tabs & Accordions installs we monitor and 72% of Modules Anywhere installs are still on an affected build.

TL;DR

• Modules Anywhere 10.0.0 fixes CVE-2026-100750 (High, 8.5): before it, a content author could override the settings of any module they embedded, and through Joomla’s Feed module read files from the server. Pro 1.5.0 to 9.0.5 is affected
• Tabs & Accordions 3.2.0 fixes CVE-2026-100751 (High, 7.5): data-rlta-url attributes accepted executable JavaScript URLs, so a content author could plant script that ran for visitors. Free and Pro 2.3.0 to 3.1.0 are affected
• Free and Pro share one version number, so mySites.guru flags both editions of both extensions
• 87% of the affected Tabs & Accordions installs we monitor are on 3.1.0, the release that fixed a different Tabs & Accordions issue two weeks ago
• Modules Anywhere 10.0.0 is marked BC BREAK, and moves several settings into a new Process Tags section
• No Joomla 3 fix: the Modules Anywhere Joomla 3 branch stopped at 7.18.0 and is affected, and Tabs & Accordions has no Joomla 3 version
• mySites.guru flags every connected Joomla site running Modules Anywhere below 10.0.0 or Tabs & Accordions 2.3.0 to 3.1.x

What changed in Modules Anywhere 10.0.0

Modules Anywhere lets you place any Joomla module inside an article with a tag. The Pro edition lets that tag override the module’s own settings, so one module can be shown with different options in different places. Before 10.0.0, any content author could use those overrides on any module they could embed.

The changelog is specific about the consequence: the fix “restricts module parameter overrides to trusted sources by default, preventing content authors from changing feed URLs and other module settings”. An author who can embed a feed module can point it at a feed they control, and the site will display whatever that feed contains, under the site’s own name.

The CVE record goes further. Joomla’s core Feed module fetches its URL on the server, and it accepts local file: URLs as well as network addresses. So the same override lets an author read files the web server can see, or make the server request internal addresses it can reach and outsiders cannot. That is server-side request forgery (CWE-918), and it is why CVE-2026-100750 scores 8.5 despite needing a logged-in author. The Feed module is the documented example, and any other module setting is open to the same override.

10.0.0 adds settings for trusted component and module sources, and only accepts overrides from those by default. A related Pro entry fixes module and title tag overrides accepting unsafe HTML element names.

What changed in Tabs & Accordions 3.2.0

The second issue scores lower. Tabs & Accordions turns simple tags in an article into tabs and accordion panels. Each panel can have a data-rlta-url attribute, and before 3.2.0 the extension accepted a javascript: URL there. The changelog entry reads, in full: “Fixes data-rlta-url attributes accepting executable JavaScript URLs”.

In practice, anyone allowed to write or edit an article could put script into a tab that ran in the browser of anyone who opened it: the browser code hands the value to window.open() when the item is activated. Joomla’s text filters see only ordinary plugin syntax when the article is saved, because the dangerous attribute is created later, when the page is rendered. That is a stored cross-site scripting issue (CWE-79), and on most Joomla sites the people who read articles include logged-in editors and administrators, so the script can run with their rights. It needs an account that can author content, which keeps it away from anonymous visitors on sites that only give authoring rights to staff.

The same release fixes title-tag attributes accepting unsafe HTML element names, and adds the new Process Tags security controls in both editions. It also moves the administrator tag-processing option into the Security settings, which is worth checking after the update if you changed it.

This is the second Tabs & Accordions fix in two weeks

On 13 September Regular Labs shipped Tabs & Accordions 3.1.0 to fix crafted data-rlta-alias attributes running JavaScript when a matching link was clicked. That was a different attribute. 3.1.0 did not touch data-rlta-url, so a site that updated promptly in September is still exposed to this one.

We can see the installed version of Tabs & Accordions on every Joomla site connected to mySites.guru, and the September update did its job: most sites moved to 3.1.0. That is exactly why so many need to move again.

This is a pattern we see with Regular Labs more than most vendors: they fix a class of problem one attribute or one feature at a time, over several releases. Sourcerer needed three releases to close one issue in August. Being fully up to date with a Regular Labs extension means you have the fixes shipped so far, and the next one may be a fortnight away.

Which Joomla sites can take these updates?

Only Joomla 4, 5 and 6 sites. Regular Labs’ own update feed was already offering Modules Anywhere 10.0.0 and Tabs & Accordions 3.2.0 to Joomla 4 to 6 by the evening of release day, unlike the September batch, where the feed lagged the changelog for part of the day.

Joomla 3 is a different story. Across the Joomla sites connected to mySites.guru, 31% of Modules Anywhere installs are on the 7.x branch, and 98% of those sites run Joomla 3. That branch has been frozen at 7.18.0 since Regular Labs stopped building for Joomla 3, and it will not get this fix. The CVE record covers every Pro release from 1.5.0, so 7.x is affected, and we now flag it for this issue on top of the July fixes it never received. Tabs & Accordions has no Joomla 3 version at all.

For those sites the answer is the one it has been since 2023: plan the move off Joomla 3. On Joomla 4 and later, 57% of Modules Anywhere installs were on 9.x on release day, most of them on 9.0.5, and a smaller group is still on 8.x. Both need 10.0.0.

How mySites.guru flags these Regular Labs releases

mySites.guru records the exact version of every extension on every connected Joomla site twice a day. On release day we added entries to our Joomla vulnerability database, and when the CVE records were published we widened them to Modules Anywhere 1.5.0 to below 10.0.0 and Tabs & Accordions 2.3.0 to below 3.2.0, so every connected site running an affected build is flagged on its dashboard and in its audit, with the version that resolves it.

Because Regular Labs ships Free and Pro under one version number, the flag cannot tell the two editions apart, so a Free Modules Anywhere site on 9.0.5 is flagged too, even though that CVE covers only Pro. That is the right way round: updating a Free install is quick and free, and a missed Pro site is not. The vulnerable extension list explains how these flags work for every extension we track.

When a whole family of extensions moves on the same day, updating them one site at a time is the part that gets skipped. mySites.guru can update Joomla extensions across every connected site from one screen, and if you would rather not babysit the next Regular Labs wave, enable extension auto-updates for the extensions you trust.

Who can author content on your Joomla sites?

Both issues start with an account that can write articles, so the size of the risk on a given site is the number of those accounts and how carefully they were given out. On a brochure site where only two staff members write content, it is small. On a membership site, a school, or anything that lets people register and contribute articles, the author role is exactly where an attacker would start.

Until every site is updated:

• Check whether front-end registration is switched on, and whether new users can reach a group with authoring rights
• Remove authoring rights from accounts that no longer need them, and delete accounts that have never logged in
• Keep Joomla’s text filters strict for Registered and Author groups, so raw HTML and script are stripped on save
• Review recently edited articles that use Tabs & Accordions or Modules Anywhere tags if you do not trust every author

If you find script or module settings you did not put there, treat the site as compromised and work through our Joomla hacked-site guide, or have us fix it for you.

If you run Regular Labs extensions on more than a few sites, mySites.guru flags every connected site the day a Regular Labs fix is published, and the free audit shows what it finds on your own sites first.