CVE-2026-65713MediumCVSS 6.5

Modals (modals) below 16.0.0 - Stored XSS and Path Traversal

Regular Labs Modals before 16.0.0 is affected by issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): decoded modal data title, description and HTML values able to execute unsafe markup (stored XSS - decoded modal HTML now strips scripts, event handlers and executable URLs); and (Pro) gallery folders accepting unsafe relative paths (path traversal). Update to Modals 16.0.0 or later (16.0.1 is a same-day bugfix follow-up). CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64795, CVE-2026-65713.

Affected versions: ≤ 15.0.0

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Check whether your sites are affected

How CVE-2026-65713 is scored

The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

6.5 Medium

CVSS 3.1, scored by CISA-ADP

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

How it is reached

AV:N Attack vector: Network. Reachable across the internet
AC:L Attack complexity: Low. Nothing to work around, it just works
PR:N Privileges required: None. No account needed
UI:N User interaction: None. Nobody has to be tricked into anything
S:U Scope: Unchanged. Contained to the extension it is in

What it does

C:L Confidentiality: Low. Some data can be read
I:L Integrity: Low. Some data can be altered
A:N Availability: None. The site stays up

Affected extensions and versions

CVE-2026-65713

Modals

Affected versions: ≤ 15.0.0

Full advisory: regularlabs.com

Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

Rules current as of 3 October 2026.