CVE-2026-85195 in Articles Anywhere Extension
Summary
by MITRE • 09/14/2026
Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0 - Articles Anywhere accepts link options such as onclick and onmouseover. In affected versions, those options become real HTML event attributes without checking the article author's trust level. The plugin syntax survives Joomla's normal Author content filter because the executable HTML is generated later.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in the Articles Anywhere extension for Joomla prior to version 20.0.0 represents a critical security flaw rooted in improper validation of user-supplied input within a privileged context. This specific issue allows for Privileged Stored Cross-Site Scripting, commonly referred to as stored XSS or persistent XSS. The core technical failure lies in the handling of link options provided by content authors. Specifically, the extension accepts HTML event attributes such as onclick and onmouseover when defining links within articles. In vulnerable versions, these attributes are processed directly into executable JavaScript code without any sanitization or validation checks regarding the trust level of the user who authored the article. This means that even if a low-privilege user writes malicious content, the extension will render it as active script upon page load for all subsequent visitors.
The operational mechanism of this exploit relies on the timing of filter application within Joomla's architecture. Normally, Joomla employs an Author Content Filter to sanitize input based on the permissions and trust level assigned to different user groups. However, in this specific implementation flaw, the malicious HTML event attributes survive this initial filtering stage because they are embedded within a custom plugin syntax that is processed later in the request lifecycle. By the time the content is rendered for display, the extension has already converted these syntactic elements into standard HTML event handlers. Consequently, when another user views an article containing the injected payload, their browser executes the malicious JavaScript code automatically. This bypasses traditional security controls designed to prevent script injection from untrusted sources.
The impact of this vulnerability is severe due to its stored nature and privileged execution context. Unlike reflected XSS attacks which require tricking a user into clicking a specific link, stored XSS persists on the server side within the database or content files. Every visitor who loads an affected page becomes a potential victim without any additional interaction beyond viewing the compromised article. Attackers can leverage this to perform session hijacking by stealing authentication cookies and tokens, thereby gaining unauthorized access to administrative accounts if those users are logged in. Furthermore, attackers may redirect victims to phishing sites designed to harvest credentials or deploy malware through drive-by download techniques. In a privileged context, where administrators frequently view content management interfaces, the risk of compromising high-privilege sessions is significantly elevated, potentially leading to full site takeover and defacement.
From an industry standards perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. The specific failure to validate input based on user trust levels before rendering it in a privileged context also relates to CWE-200 Exposure of Sensitive Information to an Unauthorized Actor and potentially CWE-611 Improper Restriction of XML External Entity Reference if similar parsing issues exist, though the primary classification remains XSS. In terms of attack vectors mapped by MITRE ATT&CK, this falls under T1059 Command and Scripting Interpreter with sub-techniques for JavaScript execution in a browser environment. It also relates to T1189 Drive-by Compromise as it can be triggered simply by visiting the compromised page.
Mitigation strategies must focus on immediate remediation of the software version followed by rigorous input validation practices. The primary and most effective mitigation is to upgrade the Articles Anywhere extension to version 20.0.0 or later, where this specific parsing flaw has been addressed. Administrators should ensure that all Joomla core components are also updated to their latest stable releases to maintain overall system integrity. For environments unable to update immediately due to compatibility constraints, a temporary workaround involves implementing strict Content Security Policy headers to restrict the execution of inline scripts and event handlers within browser contexts. Additionally, administrators should review existing articles for any injected malicious payloads that may have been stored prior to patching. Future development practices must enforce allow-list based validation for all HTML attributes processed by plugins, ensuring that only explicitly permitted properties are rendered regardless of user role or trust level.