ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-85196

Articles Anywhere (Pro) extension for Joomla · Vulnerability

CVSS 4.0 5.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-85196

Published

Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return values from request-input data tags without making them safe for the context in which the tag is used. Joomla's string input filter does not make the same value safe for HTML text, an HTML attribute and a URL. A visitor-controlled request value can therefore become an executable URL or a new event attribute in output configured by a site author.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-85196

Published

plg_system_articlesanywhere

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "packageName": "plg_system_articlesanywhere",
                    "product": "Articles Anywhere (Pro) extension for Joomla",
                    "vendor": "regularlabs.com",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "8.4.0-19.0.6"
                        }
                    ]
                }

plg_system_usersanywhere

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "packageName": "plg_system_usersanywhere",
                    "product": "Users Anywhere (Pro) extension for Joomla",
                    "vendor": "regularlabs.com",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.0.0-2.0.6"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON