CVE-2026-85196: Joomla Regular Labs Extensions XSS Vulnerability

CVE-2026-85196 Overview

CVE-2026-85196 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in two Regular Labs extensions for Joomla: Articles Anywhere Pro (versions before 20.0.0) and Users Anywhere Pro (versions before 2.1.0). The extensions return values from request-input data tags without applying context-appropriate output encoding. Joomla's built-in string input filter does not neutralize the same value for HTML text, HTML attributes, and URL contexts simultaneously. As a result, a visitor-controlled request parameter can produce an executable javascript: URL or inject a new event attribute into output configured by a site author.

Critical Impact
An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript in the victim's browser under the affected Joomla site's origin.

Affected Products

Regular Labs Articles Anywhere Pro for Joomla (versions < 20.0.0)
Regular Labs Users Anywhere Pro for Joomla (versions < 2.1.0)
Joomla sites using request-input data tags rendered by these extensions

Discovery Timeline

2026-09-14 - CVE-2026-85196 published to the National Vulnerability Database
2026-09-16 - Last updated in the NVD database

Technical Details for CVE-2026-85196

Vulnerability Analysis

The vulnerability affects data tags in Articles Anywhere Pro and Users Anywhere Pro that read values from HTTP request inputs and render them into extension output. Site authors can configure these tags to appear in HTML text, HTML attribute values, or URL contexts. The extensions rely on Joomla's generic string input filter to sanitize the value once, at input time. That single-pass filter does not encode a value in a way that is simultaneously safe for all three output contexts.

An attacker supplies a crafted request parameter that survives the input filter. When a site author has placed the data tag inside an attribute or a URL, the reflected value becomes an event handler declaration or a javascript: scheme URL. The browser then executes attacker-controlled script in the site's origin.

Root Cause

The root cause is missing context-aware output encoding. Input filtering and output encoding are distinct concerns, and a value considered safe as HTML text is not necessarily safe as an attribute value or URL. The extensions do not apply per-context escaping when substituting request values into rendered output.

Attack Vector

Exploitation requires user interaction. The attacker delivers a crafted link to a victim, typically through phishing, chat, or a third-party site. When the victim visits a page that renders the affected data tag, the reflected payload executes JavaScript in the browser session. Consequences include session token theft, forced actions in the victim's authenticated context, and content spoofing. No authentication is required from the attacker to craft the payload.

No public proof-of-concept exploit code is currently referenced for this CVE. Refer to the Regular Labs Homepage for vendor updates and technical notes.

Detection Methods for CVE-2026-85196

Indicators of Compromise

Web server access logs containing request parameters with javascript:, on event handler names, <script, or URL-encoded angle brackets targeting URLs that render Articles Anywhere or Users Anywhere content.
Referer headers pointing to external sites paired with unusual query strings on Joomla article endpoints.
Browser console reports or Content Security Policy (CSP) violation reports referencing inline script execution on pages served by the affected extensions.

Detection Strategies

Inspect HTTP request logs for reflected payload patterns in query strings and POST bodies delivered to pages that embed Articles Anywhere or Users Anywhere data tags.
Deploy a web application firewall (WAF) rule set that flags reflected XSS payloads, including event-handler injection and javascript: URL schemes, on Joomla endpoints.
Correlate outbound requests from user browsers to unexpected domains shortly after visits to Joomla pages containing the affected extensions.

Monitoring Recommendations

Enable and monitor CSP report-only headers to surface script execution attempts sourced from reflected input.
Alert on repeated 200 responses to URLs containing suspicious encoded characters (%3C, %22, %27) targeting article or user rendering endpoints.
Track browser telemetry for unexpected script execution or DOM modifications on pages that include Regular Labs extension output.

How to Mitigate CVE-2026-85196

Immediate Actions Required

Upgrade Articles Anywhere Pro to version 20.0.0 or later, and Users Anywhere Pro to version 2.1.0 or later.
Audit site templates and article content for data tags that place request-input values into HTML attributes or URL contexts.
Rotate administrator session cookies and force re-authentication if reflected XSS activity is suspected in access logs.

Patch Information

Regular Labs addresses the issue in Articles Anywhere Pro 20.0.0 and Users Anywhere Pro 2.1.0. Consult the Regular Labs Homepage for release notes and download links. Verify extension versions in the Joomla administrator under Extensions → Manage after upgrading.

Workarounds

Remove or disable data tags from Articles Anywhere and Users Anywhere that reflect request-input values until the upgrade is applied.
Deploy a WAF rule to block requests containing javascript: schemes or HTML event handler names in query parameters targeting Joomla content endpoints.
Enforce a strict Content Security Policy that disallows inline script execution and unsafe schemes to limit exploitation impact.

bash

# Example WAF pattern (ModSecurity-style) to block reflected XSS payloads
SecRule ARGS "@rx (?i)(javascript:|on[a-z]+\s*=|<script)" \
    "id:1085196,phase:2,deny,status:403,\
     msg:'Potential reflected XSS targeting Regular Labs extensions (CVE-2026-85196)'"