EUVD-2026-77214
GHSA-xh7r-fjj6-r3qm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reflected XSS with network delivery, no auth required, user click needed; scope changes to victim browser enabling session theft (C:L/I:L).
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return values from request-input data tags without making them safe for the context in which the tag is used. Joomla's string input filter does not make the same value safe for HTML text, an HTML attribute and a URL. A visitor-controlled request value can therefore become an executable URL or a new event attribute in output configured by a site author.
AnalysisAI
Reflected cross-site scripting in regularlabs.com's Articles Anywhere (versions before 20.0.0) and Users Anywhere (versions before 2.1.0) extensions for Joomla allows unauthenticated remote attackers to inject executable JavaScript into victims' browsers. The extensions expose a data-tag templating system that pulls values from visitor-controlled request parameters and renders them in output without context-sensitive encoding - Joomla's built-in string input filter does not distinguish between safe-for-HTML-text, safe-for-attribute, and safe-for-URL contexts, so a malicious request value can materialize as an event handler attribute or a javascript: URL wherever a site author has placed a data tag. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three conditions to align: (1) the target Joomla site must have Articles Anywhere (any version < 20.0.0) or Users Anywhere (any version < 2.1.0) installed and published; (2) a site author must have configured at least one publicly accessible page, article, or module that uses a request-input data tag from one of these extensions in an HTML attribute or URL output context - sites that only use these extensions in plain-text contexts are not exploitable via this path; and (3) a victim user must follow or visit a crafted URL containing the malicious payload (UI:P). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) with AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N accurately captures the moderate real-world risk: network reachability and no privilege requirement enable broad delivery, but mandatory victim interaction (UI:P) rules out automated mass compromise and places this below critical threshold. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Articles Anywhere / Articles Anywhere Pro to version 20.0.0 or later and Users Anywhere / Users Anywhere Pro to version 2.1.0 or later via the Joomla extension manager or the vendor's site at https://www.regularlabs.com/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery in Regular Labs' Articles Anywhere Pro and Users Anywhere Pro extensions for Joomla allows u
Stored cross-site scripting (XSS) in multiple Regular Labs Joomla extensions allows an authenticated content author to i
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today