10
CVEs
2
Critical
6
High
0
KEV
0
PoC
8
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
6
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (30)
Conditional Content Extension For Joomla
5
Articles Anywhere Extension For Joomla
5
Geoip Extension For Joomla
5
Content Templater Pro Extension For Joomla
4
Sourcerer Extension For Joomla
4
Modules Anywhere Extension For Joomla
4
Advanced Module Manager Extension For Joomla
4
Users Anywhere Pro Extension For Joomla
3
Articles Anywhere Pro Extension For Joomla
3
Users Anywhere Extension For Joomla
3
Rereplacer Extension For Joomla
3
Ip Login Extension For Joomla
3
Cache Cleaner Pro Extension For Joomla
3
Rereplacer Extension Pro For Joomla
3
Cache Cleaner Extension For Joomla
2
Snippets Pro Extension For Joomla
2
Snippets Extension For Joomla
2
Modals Extension For Joomla
2
Db Replacer Extension For Joomla
2
PHP
2
Rereplacer Pro Extension For Joomla
2
Keyboard Shortcuts Extension For Joomla
2
Regular Labs Extension Manager Extension For Joomla
2
Tooltips Extension For Joomla
2
Content Templater Extension For Joomla
2
Modals Pro Extension For Joomla
2
What Nothing Extension For Joomla
1
Modals Free Pro Extension For Joomla
1
Quick Index Free Pro Extension For Joomla
1
Snippets Free Extension For Joomla
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-74253 | Remote code execution in Regular Labs Sourcerer for Joomla (versions before 14.0.0) allows unauthenticated attackers to inject and execute arbitrary PHP via {source} blocks. The extension parses {source} tags found anywhere in Joomla's final rendered HTML without reliably verifying where that content originated, so attacker-controlled reflected input reaching the page body gets evaluated as trusted code. Rated CVSS 4.0 10.0 (critical); no public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 10.0 | 0.3% | 50 |
No patch
|
| CVE-2026-85192 | Remote code execution in Regular Labs' Conditional Content Pro extension for Joomla (versions before 8.0.0) lets an author with article-publishing rights embed inline PHP inside Condition Rules, which the extension hands to its Conditions evaluator without verifying who authored the content. Because Joomla's standard Author text filter preserves the rule syntax, publishing a crafted article executes the attacker's PHP as the web-server process. No public exploit has been identified at time of analysis, and the flaw requires an authenticated, privileged Joomla account. | CRITICAL | 9.4 | 0.5% | 47 |
No patch
|
| CVE-2026-85191 | Stored cross-site scripting in regularlabs.com's Tabs & Accordions (Free and Pro) extension for Joomla, versions prior to 3.1.0, allows a privileged authenticated attacker to inject and permanently persist arbitrary JavaScript into page output by supplying a crafted value in the rtla-alias configuration field. The extension's link-rewriting renderer embeds the alias directly into an HTML onclick attribute as a JavaScript string argument, applying neither JavaScript-string escaping nor HTML-attribute encoding, so a crafted alias breaks both quoting contexts and executes in every subsequent visitor's browser. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-88853 | Stored cross-site scripting in the Modals Pro extension for Joomla (regularlabs.com) versions prior to 17.0.0 allows an authenticated Author-level user to inject executable JavaScript via documented event handler options (on-open, on-closed) embedded in article content. The extension intentionally supports JavaScript lifecycle events for modal dialogs but fails to enforce access control distinguishing which roles may supply executable code versus static configuration parameters - enabling a lower-privileged author to weaponize a trusted-user feature. When a higher-privileged user views the crafted article, the modal fires the injected script in their browser context. No public exploit or CISA KEV listing exists at time of analysis. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-85189 | Stored cross-site scripting in the Regular Labs Modals extension for Joomla (all versions before 17.0.0) allows high-privileged content authors to inject executable browser URL schemes - such as javascript: - into modal destination fields, which the extension passes unvalidated into both the generated anchor href and the iframe source path. When any site visitor subsequently renders the affected page, the stored payload executes as JavaScript in their browser without requiring the Pro JavaScript Events feature to be enabled. No public exploit has been identified at time of analysis; the vendor-released fix is version 17.0.0. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-85195 | Stored XSS in regularlabs.com's Articles Anywhere Joomla extension (versions prior to 20.0.0) lets authenticated article authors inject arbitrary JavaScript via link event handler options (onclick, onmouseover) in plugin syntax tags. The injected payload bypasses Joomla's built-in Author content filter because Articles Anywhere renders the event handler attributes into live HTML after the CMS filter has already processed the content. No public exploit has been identified at time of analysis, but the filter-bypass is architectural and cannot be mitigated without patching. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-85190 | Stored cross-site scripting in Quick Index (Free/Pro) extension for Joomla allows a privileged attacker to inject persistent script payloads by supplying a crafted class configuration value that breaks out of its HTML attribute context. Because Quick Index generates executable HTML output after Joomla's built-in content security filter has already processed plugin syntax, the platform's native XSS protection cannot intercept the injected payload. All versions prior to 5.0.5 are affected; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-88852 | Stored cross-site scripting in the Regular Labs Snippets extensions for Joomla (Free < 7.0.0, Pro < 11.0.0) allows a lower-privileged Joomla author to inject malicious script into Snippet content by passing an unsafe value through the extension's article tag variable substitution mechanism, specifically via the url option. Because the affected versions do not validate the article author's trust level before substituting their tag-supplied variables into security-sensitive positions defined by a trusted Snippet author, the injected payload executes in the browser of any higher-privileged user who views the rendered article. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-85188 | Database field disclosure in four Regular Labs Joomla extensions - Advanced Module Manager, Conditional Content, Content Templater, and ReReplacer - allows an authenticated high-privilege user to read arbitrary database fields outside the intended scope. The Conditions editor feature accepts user-supplied database table and column names from the HTTP request, which are quoted as SQL identifiers (preventing SQL injection) but are not restricted to the tables and columns supported by Regular Labs integrations. An attacker with administrative access can therefore query unrelated database fields, potentially exposing sensitive Joomla database content such as user records or configuration values. No public exploit code or active exploitation is identified at time of analysis. | MEDIUM | 6.9 | 0.2% | 34 |
No patch
|
| CVE-2026-85196 | Reflected cross-site scripting in regularlabs.com's Articles Anywhere (versions before 20.0.0) and Users Anywhere (versions before 2.1.0) extensions for Joomla allows unauthenticated remote attackers to inject executable JavaScript into victims' browsers. The extensions expose a data-tag templating system that pulls values from visitor-controlled request parameters and renders them in output without context-sensitive encoding - Joomla's built-in string input filter does not distinguish between safe-for-HTML-text, safe-for-attribute, and safe-for-URL contexts, so a malicious request value can materialize as an event handler attribute or a javascript: URL wherever a site author has placed a data tag. No public exploit identified at time of analysis. | MEDIUM | 5.3 | 0.3% | 26 |
No patch
|