Modules Anywhere 10.0.0 and Tabs & Accordions 3.2.0 Close Two Content Author Security Holes

Regular Labs released Modules Anywhere 10.0.0 and Tabs & Accordions 3.2.0 for Joomla on 27 September 2026, and each has a [SECURITY FIX] entry in its changelog. Both close a way for someone with permission to write content to reach further than their role should allow: in Modules Anywhere, by changing the settings of any module they embed; in Tabs & Accordions, by placing JavaScript in a tab that runs in a visitor’s browser.

These are Joomla extension fixes, not Joomla core. Regular Labs found and fixed them; we did not report them, and the vendor credits no one.

TL;DR

• Tabs & Accordions 3.2.0 stops data-rlta-url attributes from accepting executable JavaScript URLs. Before it, a content author could plant script in a tab or accordion that ran for visitors
• Modules Anywhere 10.0.0 only accepts module parameter overrides from trusted sources by default. Before it, a content author could change a feed module’s URL and other settings of any module they embedded
• Both fixes are tagged PRO. Free and Pro share one version number, so mySites.guru flags both editions
• 87% of the affected Tabs & Accordions installs we monitor are on 3.1.0, the release that fixed a different Tabs & Accordions issue two weeks ago
• Modules Anywhere 10.0.0 is marked BC BREAK, and moves several settings into a new Process Tags section
• No Joomla 3 fix: the Modules Anywhere Joomla 3 branch stopped at 7.18.0, and Tabs & Accordions has no Joomla 3 version
• mySites.guru flags every connected Joomla site running Modules Anywhere 9.x or Tabs & Accordions 3.0.0 to 3.1.x

What changed in Tabs & Accordions 3.2.0

Tabs & Accordions turns simple tags in an article into tabs and accordion panels. Each panel can have a data-rlta-url attribute, and before 3.2.0 the extension accepted a javascript: URL there. The changelog entry reads, in full: “Fixes data-rlta-url attributes accepting executable JavaScript URLs”.

In practice, anyone allowed to write or edit an article could put script into a tab that ran in the browser of anyone who used it. That is a stored cross-site scripting issue (CWE-79), and on most Joomla sites the people who read articles include logged-in editors and administrators, so the script can run with their rights. It needs an account that can author content, which keeps it away from anonymous visitors on sites that only give authoring rights to staff.

The same release fixes title-tag attributes accepting unsafe HTML element names, and adds the new Process Tags security controls in both editions. It also moves the administrator tag-processing option into the Security settings, which is worth checking after the update if you changed it.

This is the second Tabs & Accordions fix in two weeks

On 13 September Regular Labs shipped Tabs & Accordions 3.1.0 to fix crafted data-rlta-alias attributes running JavaScript when a matching link was clicked. That was a different attribute. 3.1.0 did not touch data-rlta-url, so a site that updated promptly in September is still exposed to this one.

We can see the installed version of Tabs & Accordions on every Joomla site connected to mySites.guru, and the September update did its job: most sites moved to 3.1.0. That is exactly why so many need to move again.

This is a pattern we see with Regular Labs more than most vendors: they fix a class of problem one attribute or one feature at a time, over several releases. Sourcerer needed three releases to close one issue in August. Being fully up to date with a Regular Labs extension means you have the fixes shipped so far, and the next one may be a fortnight away.

What changed in Modules Anywhere 10.0.0

Modules Anywhere lets you place any Joomla module inside an article with a tag. The Pro edition lets that tag override the module’s own settings, so one module can be shown with different options in different places. Before 10.0.0, any content author could use those overrides on any module they could embed.

The changelog is specific about the consequence: the fix “restricts module parameter overrides to trusted sources by default, preventing content authors from changing feed URLs and other module settings”. An author who can embed a feed module can point it at a feed they control, and the site will display whatever that feed contains, under the site’s own name. The same goes for any other setting the site owner chose for that module.

10.0.0 adds settings for trusted component and module sources, and only accepts overrides from those by default. A related Pro entry fixes module and title tag overrides accepting unsafe HTML element names.

Which Joomla sites can take these updates?

Only Joomla 4, 5 and 6 sites. Regular Labs’ own update feed was already offering Modules Anywhere 10.0.0 and Tabs & Accordions 3.2.0 to Joomla 4 to 6 by the evening of release day, unlike the September batch, where the feed lagged the changelog for part of the day.

Joomla 3 is a different story. Across the Joomla sites connected to mySites.guru, 31% of Modules Anywhere installs are on the 7.x branch, and 98% of those sites run Joomla 3. That branch has been frozen at 7.18.0 since Regular Labs stopped building for Joomla 3, and it will not get this fix. The changelog does not say whether the 7.x code has the same behaviour, so we have not flagged 7.x for this issue, but those sites are already flagged for the July fixes they never received. Tabs & Accordions has no Joomla 3 version at all.

For those sites the answer is the one it has been since 2023: plan the move off Joomla 3. Of the rest, 57% of Modules Anywhere installs are on 9.x and need 10.0.0, and most of those are already on 9.0.5, the latest 9.x release, so they are sites whose owners keep up.

How mySites.guru flags these Regular Labs releases

mySites.guru records the exact version of every extension on every connected Joomla site twice a day. On release day we added entries to our Joomla vulnerability database for Modules Anywhere 9.0.0 to below 10.0.0 and Tabs & Accordions 3.0.0 to below 3.2.0, so every connected site running an affected build is flagged on its dashboard and in its audit, with the version that resolves it.

Because Regular Labs ships Free and Pro under one version number, the flag cannot tell the two editions apart, and a Free site on 9.0.5 is flagged too. That is the right way round: updating a Free install is quick and free, and a missed Pro site is not. The vulnerable extension list explains how these flags work for every extension we track.

When a whole family of extensions moves on the same day, updating them one site at a time is the part that gets skipped. mySites.guru can update Joomla extensions across every connected site from one screen, and if you would rather not babysit the next Regular Labs wave, enable extension auto-updates for the extensions you trust.

Who can author content on your Joomla sites?

Both issues start with an account that can write articles, so the size of the risk on a given site is the number of those accounts and how carefully they were given out. On a brochure site where only two staff members write content, it is small. On a membership site, a school, or anything that lets people register and contribute articles, the author role is exactly where an attacker would start.

Until every site is updated:

• Check whether front-end registration is switched on, and whether new users can reach a group with authoring rights
• Remove authoring rights from accounts that no longer need them, and delete accounts that have never logged in
• Keep Joomla’s text filters strict for Registered and Author groups, so raw HTML and script are stripped on save
• Review recently edited articles that use Tabs & Accordions or Modules Anywhere tags if you do not trust every author

If you find script or module settings you did not put there, treat the site as compromised and work through our Joomla hacked-site guide, or have us fix it for you.

If you run Regular Labs extensions on more than a few sites, mySites.guru flags every connected site the day a Regular Labs fix is published, and the free audit shows what it finds on your own sites first.