Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0

Published 54 d ago 2026-09-14 · modified 51 d ago 2026-09-16 · JSON

CVSS

5.3

v4.0 · CNA

CISA KEV

not known exploited

EPSS

0.4%

percentile 38%

Public exploits

none known

Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return values from request-input data tags without making them safe for the context in which the tag is used. Joomla's string input filter does not make the same value safe for HTML text, an HTML attribute and a URL. A visitor-controlled request value can therefore become an executable URL or a new event attribute in output configured by a site author.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 54 d ago 2026-09-14

Exploit prediction (EPSS)

0.44% probability of exploitation in the next 30 days, higher than 38% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	5.3	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N`
CNA	4.0	5.3	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Affected products

regularlabs.com Articles Anywhere (Pro) extension for Joomla
regularlabs.com Users Anywhere (Pro) extension for Joomla

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

regularlabs.com / · product

Sources

CVE List: CVE-2026-85196
NVD: CVE-2026-85196

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary