EUVD-2026-77310
GHSA-jvv6-hc62-cm99
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:X/U:X
Author-level CMS access (PR:L) required; victim must view the article (UI:R, S:C) as is standard for stored XSS with browser-context impact.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
3DescriptionCVE.org
Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0 - Articles Anywhere accepts link options such as onclick and onmouseover. In affected versions, those options become real HTML event attributes without checking the article author's trust level. The plugin syntax survives Joomla's normal Author content filter because the executable HTML is generated later.
AnalysisAI
Stored XSS in regularlabs.com's Articles Anywhere Joomla extension (versions prior to 20.0.0) lets authenticated article authors inject arbitrary JavaScript via link event handler options (onclick, onmouseover) in plugin syntax tags. The injected payload bypasses Joomla's built-in Author content filter because Articles Anywhere renders the event handler attributes into live HTML after the CMS filter has already processed the content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concrete prerequisites must be met: (1) the Articles Anywhere Free or Pro extension must be installed and enabled on the Joomla site; (2) the attacker must hold at minimum a Joomla Author account, granting the ability to create or edit articles; (3) a victim with a meaningful browser session - typically an Editor, Publisher, or Administrator - must load a page rendering the attacker-controlled article with Articles Anywhere active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N - score 7.5) warrants scrutiny on two metrics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Articles Anywhere to version 20.0.0 or later, which enforces author trust-level checking before rendering link options as HTML event attributes; the vendor advisory is at https://www.regularlabs.com/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Joomla installations running Articles Anywhere prior to version 20.0.0 and identify the scope of article authoring privileges across these systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today