CVE-2026-85196 in Articles Anywhere Extension
Summary
by MITRE • 09/14/2026
Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return values from request-input data tags without making them safe for the context in which the tag is used. Joomla's string input filter does not make the same value safe for HTML text, an HTML attribute and a URL. A visitor-controlled request value can therefore become an executable URL or a new event attribute in output configured by a site author.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified involves reflected cross-site scripting flaws within two specific Joomla extensions developed by regularlabs.com: Articles Anywhere version 20.0.0 and earlier, and Users Anywhere version 2.1.0 and earlier. These components are designed to allow site administrators to embed dynamic content from articles or user data into various parts of a website using shortcodes or tags. The core technical flaw lies in the insufficient sanitization of input values retrieved directly from HTTP request parameters before they are rendered within HTML output contexts. Specifically, when these extensions process visitor-controlled request data for use in article bodies or user profile displays, they fail to apply context-appropriate encoding rules. This oversight allows an attacker to inject malicious script payloads that execute in the victim's browser upon rendering of the affected content.
From a technical perspective, this issue stems from Joomla’s native string input filter not providing sufficient protection across all HTML contexts simultaneously. The vulnerability exploits the fact that a single unescaped value can be interpreted differently depending on where it appears within an HTML document structure. For instance, if user-supplied data is inserted into an attribute context without proper encoding, it may break out of its intended scope and execute as JavaScript via event handlers such as onclick or onload. Alternatively, if the input is placed in a URL-based attribute like href or src, it can facilitate script execution through javascript: URIs or other protocol handlers. The extensions do not distinguish between these contexts when sanitizing inputs, leading to scenarios where malicious code becomes executable simply by being included in a tag configured by a site author who trusts the underlying data source.
The operational impact of this vulnerability is significant for any Joomla website utilizing these specific extension versions. Attackers can craft specially crafted URLs or manipulate form submissions that trigger the reflection of their payload within page content viewed by legitimate users. Once executed, the malicious script operates with the same privileges as other scripts running on the domain, potentially allowing session hijacking through cookie theft, credential harvesting via fake login forms injected into the DOM, defacement of website appearance, or redirection to phishing sites. Since the vulnerability is reflected rather than stored, it typically requires social engineering tactics such as sending a malicious link to targeted users, but its ease of exploitation makes it a high-risk threat for public-facing Joomla installations that rely on these extensions for dynamic content delivery.
This flaw aligns with Common Weakness Enumeration (CWE) category CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More specifically, the context-dependent nature of the failure relates to CWE-83 and CWE-84 variants concerning improper encoding in HTML attributes or URLs. In terms of offensive security frameworks, this vulnerability maps directly to MITRE ATT&CK technique T1059.007, which covers JavaScript execution within web browsers as part of client-side code injection attacks. The exploitation path involves injecting executable content into a trusted website’s output stream, leveraging the trust users place in the domain hosting the Joomla site.
Mitigation strategies must prioritize immediate version updates to address these specific flaws. Administrators running Articles Anywhere should upgrade to version 20.0.0 or later, while those using Users Anywhere must update to version 2.1.0 or higher where the input filtering logic has been corrected to apply context-aware escaping mechanisms. Until patches are applied, site administrators can implement temporary compensating controls by disabling shortcodes that accept user-supplied data in sensitive contexts or by configuring web application firewalls to detect and block common XSS payloads within request parameters associated with these extensions. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact of successful exploitation by restricting script execution sources, although this is not a substitute for fixing the underlying input validation deficiency.