Articles Anywhere Free Pro Extension For Joomla
Monthly
Stored XSS in regularlabs.com's Articles Anywhere Joomla extension (versions prior to 20.0.0) lets authenticated article authors inject arbitrary JavaScript via link event handler options (onclick, onmouseover) in plugin syntax tags. The injected payload bypasses Joomla's built-in Author content filter because Articles Anywhere renders the event handler attributes into live HTML after the CMS filter has already processed the content. No public exploit has been identified at time of analysis, but the filter-bypass is architectural and cannot be mitigated without patching.
Stored XSS in regularlabs.com's Articles Anywhere Joomla extension (versions prior to 20.0.0) lets authenticated article authors inject arbitrary JavaScript via link event handler options (onclick, onmouseover) in plugin syntax tags. The injected payload bypasses Joomla's built-in Author content filter because Articles Anywhere renders the event handler attributes into live HTML after the CMS filter has already processed the content. No public exploit has been identified at time of analysis, but the filter-bypass is architectural and cannot be mitigated without patching.