CVE-2026-85196: Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0
Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return values from request-input data tags without making them safe for the context in which the tag is used. Joomla's string input filter does not make the same value safe for HTML text, an HTML attribute and a URL. A visitor-controlled request value can therefore become an executable URL or a new event attribute in output configured by a site author.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
regularlabs.com Joomla Articles Anywhere extensionto a version that resolves this vulnerability.Fixed in 20.0.0 - Upgrade
Upgrade
regularlabs.com Joomla Users Anywhere extensionto a version that resolves this vulnerability.Fixed in 2.1.0
Event History
Frequently Asked Questions
Which installations are exposed to this issue?
The affected products are Articles Anywhere Pro before 20.0.0 and Users Anywhere Pro before 2.1.0. Exposure occurs where a site author has configured output that uses request-input data tags.
What does an attacker need to exploit the issue?
An attacker needs to control a request value that is returned through a request-input data tag. The value becomes dangerous when it is placed into output as an executable URL or as a new event attribute.
How can I identify potentially vulnerable tag usage?
Review configured request-input data tags and determine how their returned values are inserted into page output. Tags used in HTML text, HTML attributes, or URLs require context-appropriate handling because Joomla's string input filter does not make one value safe for all of those contexts.