CVE-2026-85195: Joomla Articles Anywhere XSS Vulnerability

CVE-2026-85195 Overview

CVE-2026-85195 is a stored Cross-Site Scripting (XSS) vulnerability in the Regular Labs Articles Anywhere extension for Joomla, affecting versions prior to 20.0.0. The extension accepts link options such as onclick and onmouseover, which are rendered as real HTML event attributes without verifying the article author's trust level. Because the extension generates the executable HTML after Joomla processes content, the plugin syntax bypasses the standard Author content filter. An authenticated user with article authoring privileges can inject persistent JavaScript that executes in the browser of any visitor who views the affected article, including administrators.

Critical Impact
Authenticated Author-level users can store JavaScript payloads that execute in higher-privileged users' sessions, enabling account takeover and administrative action hijacking.

Affected Products

Regular Labs Articles Anywhere extension for Joomla
All versions prior to 20.0.0
Joomla installations that expose article authoring to non-Super-User accounts

Discovery Timeline

2026-09-14 - CVE-2026-85195 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-85195

Vulnerability Analysis

The flaw is a stored XSS issue classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Articles Anywhere provides a shortcode-style plugin syntax that lets editors embed article content and metadata elsewhere on the site. Link-related options within that syntax, including onclick and onmouseover, are translated into real HTML event handler attributes at render time.

Joomla enforces a content filter that restricts HTML tags and attributes based on the user group. Author-level accounts normally cannot introduce script-executing markup. However, the malicious payload in this case is not present as HTML during the initial filter pass. It exists only as plugin syntax and is expanded into HTML after Joomla's Author filter runs. This ordering allows the payload to slip past the sanitization pipeline entirely.

When a visitor loads the affected article, the injected event handler fires in the visitor's browser under the site's origin, executing attacker-controlled JavaScript.

Root Cause

The root cause is a trust boundary error in the extension's rendering pipeline. Articles Anywhere does not consult the author's Joomla ACL group before emitting event handler attributes, and its HTML output is generated in a plugin phase that runs after Joomla's group-based content filter.

Attack Vector

An attacker with an authenticated Author-tier account authors or edits an article containing an Articles Anywhere shortcode that includes an event handler such as onclick or onmouseover pointing at attacker-controlled JavaScript. When any higher-privileged user, such as an Administrator or Super User, views a page that renders the injected article, the script executes in their session. This enables cookie theft, forced administrative actions through Joomla's backend, and pivoting to server-side code execution through Joomla's template or extension installation features.

No verified public exploit code is available. The mechanism is described in prose based on the vendor description. See the Regular Labs Official Website for extension documentation and updates.

Detection Methods for CVE-2026-85195

Indicators of Compromise

Article content in the Joomla database containing Articles Anywhere plugin syntax with onclick, onmouseover, onerror, onload, or other on* event handler tokens
Unexpected outbound requests from administrator browsers to unfamiliar domains shortly after viewing article pages
New Super User accounts or modified user privileges without a corresponding audit trail entry
Newly installed Joomla extensions or template changes originating from administrator sessions

Detection Strategies

Query the #__content table for shortcode patterns containing event handler attributes, for example LIKE '%{article%on%=%'
Review web server access logs for POST requests to /administrator/index.php?option=com_content originating from Author-level accounts that produce content matching the pattern above
Inspect rendered article HTML in staging or crawler snapshots for on* attributes attached to anchor tags

Monitoring Recommendations

Enable Joomla's action logs for content creation and modification events, and forward them to a centralized log store for correlation
Alert on privilege changes, new Super User creation, and extension installation events initiated from administrator sessions
Monitor Content Security Policy (CSP) violation reports for inline script execution attempts on article pages

How to Mitigate CVE-2026-85195

Immediate Actions Required

Upgrade the Regular Labs Articles Anywhere extension to version 20.0.0 or later on all Joomla instances
Audit existing article content for Articles Anywhere shortcodes containing event handler attributes and remove any unauthorized entries
Rotate session tokens and review Super User account membership after patching
Restrict article authoring permissions to trusted accounts until the upgrade is verified in production

Patch Information

Upgrade Articles Anywhere to version 20.0.0 or later. Refer to the Regular Labs Official Website for the current release and changelog. No vendor advisory URL was published in the CVE record at the time of writing.

Workarounds

Temporarily disable the Articles Anywhere plugin in the Joomla Extensions Manager until the upgrade is applied
Remove article authoring privileges from untrusted user groups until the extension is patched
Deploy a strict Content Security Policy that disallows inline event handlers, reducing the impact of any residual injection

bash

# Disable the plugin via Joomla CLI until patched
php cli/joomla.php extension:disable --name="Articles Anywhere"

# After upgrade, re-enable and verify version
php cli/joomla.php extension:list | grep -i "articles anywhere"