Keyboard Shortcuts (keyboardshortcuts) below 4.0.0 - Authenticated JavaScript Injection (Stored XSS)

Regular Labs Keyboard Shortcuts before 4.0.0 is affected by an issue fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): custom shortcut action overrides accepting arbitrary inline JavaScript (a BC break now restricts overrides to Joomla tasks, approved helpers and constrained administrator redirects), plus privileged AJAX endpoints not consistently enforcing valid tokens and permissions. Shortcuts are administrator-configured, so exploitation is authenticated, but a lower-privileged or compromised admin could inject persistent JavaScript. Update to Keyboard Shortcuts 4.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-65756.

Affected versions: ≤ 3.2.5

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions