EUVD-2026-77213
GHSA-h9wr-65g5-jgq7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:X/U:X
Requires Joomla author account (PR:L), specific Snippet template configuration (AC:H), and privileged victim to view the page (UI:R); scope change applies as XSS executes in victim's browser.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
3DescriptionCVE.org
Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.0 - Snippets substitutes variable values supplied by an article tag into saved Snippet content. The affected versions do not consider the article author's trust level. A lower-privileged author can therefore place an unsafe value into a security-sensitive position chosen by the trusted Snippet author.
AnalysisAI
Stored cross-site scripting in the Regular Labs Snippets extensions for Joomla (Free < 7.0.0, Pro < 11.0.0) allows a lower-privileged Joomla author to inject malicious script into Snippet content by passing an unsafe value through the extension's article tag variable substitution mechanism, specifically via the url option. Because the affected versions do not validate the article author's trust level before substituting their tag-supplied variables into security-sensitive positions defined by a trusted Snippet author, the injected payload executes in the browser of any higher-privileged user who views the rendered article. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker holds a Joomla author account or equivalent low-privilege role capable of creating or editing articles that include Snippets tags; (2) a higher-trusted Snippet author has previously defined and published at least one Snippet template that exposes a security-sensitive output position - specifically the url option - to user-supplied variable substitution from article tag calls; and (3) a privileged user (administrator, manager, or editor) subsequently views the article containing the malicious tag call in their browser. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The reported CVSS 4.0 base vector scores 7.5 (High), but the PR:H metric appears to overstate the attacker's required privilege - a Joomla 'author' is a relatively low-trust role (analogous to PR:L in CVSS 3.1 terms), meaning the attack is accessible to a broader set of site contributors than the score implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Snippets Free to version 7.0.0 or later and Snippets Pro to version 11.0.0 or later via the Regular Labs update channel at https://www.regularlabs.com/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Joomla installations using Regular Labs Snippets extension and determine the current version deployed on each system. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today