Articles Anywhere CVE-2026-85196

Exploitation requires three conditions to align: (1) the target Joomla site must have Articles Anywhere (any version < 20.0.0) or Users Anywhere (any version < 2.1.0) installed and published; (2) a site author must have configured at least one publicly accessible page, article, or module that uses a request-input data tag from one of these extensions in an HTML attribute or URL output context - sites that only use these extensions in plain-text contexts are not exploitable via this path; and (3) a victim user must follow or visit a crafted URL containing the malicious payload (UI:P). The attacker requires no authentication (PR:N). Exploitation is limited to reflected XSS - there is no stored/persistent variant described. Attackers cannot exploit this against sites that have the extensions installed but have not placed request-input data tags in page output.

The CVSS 4.0 score of 5.3 (Medium) with AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N accurately captures the moderate real-world risk: network reachability and no privilege requirement enable broad delivery, but mandatory victim interaction (UI:P) rules out automated mass compromise and places this below critical threshold. No EPSS data was provided in the input, and this CVE does not appear in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The impact scope is limited to the vulnerable system (VC:L/VI:L, no subsequent-system impact), meaning a successful attack yields session hijacking or limited page manipulation rather than server-side compromise. The practical risk is further constrained by deployment topology: the vulnerability fires only on pages where a site author has placed a request-input data tag, so not every page of every affected Joomla site is exploitable. That said, even a mid-sized municipal IT team in radom running Joomla sites with these extensions should treat patching as a routine near-term priority, particularly for sites serving authenticated users whose session cookies could be harvested. The missing EPSS score and absence of a direct advisory URL (only the vendor's homepage is referenced) are data gaps that slightly reduce confidence.

An attacker identifies a Joomla page that uses an Articles Anywhere or Users Anywhere data tag to echo a request parameter into an HTML attribute (such as a link href or an img src). The attacker crafts a URL containing a javascript: payload or an injected event handler in the relevant parameter, then socially engineers a logged-in site user into clicking the link. When the victim's browser renders the page, the unsanitized value executes as JavaScript, allowing the attacker to steal the session cookie or perform actions on behalf of the victim.