CVE-2026-85195

Articles Anywhere, a Joomla content plugin from Regular Labs (regularlabs.com), contains a privileged stored cross-site scripting flaw (CVSS v4.0 7.5) in versions before 20.0.0: it accepts link options such as onclick and onmouseover and renders them as real HTML event attributes without checking the article author's trust level. An attacker with at least Joomla Author-level permissions can embed these options in the plugin's tag inside an article, and the malicious syntax survives Joomla's normal Author content filter because the executable HTML is only generated later, when the page is rendered. When a victim — potentially an administrator viewing the article in the backend — loads the affected page, the injected event handler executes attacker-controlled JavaScript in their session, enabling session or cookie theft and full site takeover (high confidentiality and integrity impact). Affected deployments are Joomla sites running Articles Anywhere before 20.0.0, especially those that let untrusted or semi-trusted users author content that the plugin processes. No public proof of concept is known, the CVE is not on CISA's KEV list, and there is no evidence of in-the-wild exploitation to date.

What to do: Upgrade Articles Anywhere to version 20.0.0 or later immediately. If upgrading is delayed, restrict the plugin so it does not process content from low-trust author groups, and do not rely on Joomla's built-in Author content filter, since the plugin syntax bypasses it. Audit existing articles for Articles Anywhere plugin tags carrying link options with event-handler attributes (e.g., onclick, onmouseover) and review user accounts and logs for signs of injected payloads or session abuse.