CVE-2026-85195: Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0
Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0 - Articles Anywhere accepts link options such as onclick and onmouseover. In affected versions, those options become real HTML event attributes without checking the article author's trust level. The plugin syntax survives Joomla's normal Author content filter because the executable HTML is generated later.
Affected Software
Event History
Frequently Asked Questions
Which users can introduce the malicious content?
Article authors can supply link options such as onclick or onmouseover in Articles Anywhere plugin syntax. The affected extension does not check the author's trust level before converting those options into HTML event attributes.
Why does Joomla's normal Author content filter not prevent this?
The plugin syntax remains in the article content during Joomla filtering. Articles Anywhere generates the executable HTML later, bypassing that normal Author content-filtering step.
Which installations are affected?
Articles Anywhere for Joomla versions earlier than 20.0.0 are affected. The provided information does not identify configuration-specific prerequisites or mitigations short of using a non-affected version.