CVE-2026-88852

Regular Labs Snippets for Joomla contains a stored cross-site scripting (XSS) flaw in how the extension substitutes variable values supplied through article tags into saved Snippet content. Because affected versions do not check the article author's trust level, a lower-privileged author can inject an unsafe value — for example via the url option — into a security-sensitive position in content designed by a trusted Snippet author. Successful exploitation causes the attacker's script to execute in the browsers of site visitors or higher-privileged users such as administrators, enabling cookie/session theft or malicious actions taken as the victim. The affected products are Snippets Free for Joomla before 7.0.0 and Snippets Pro for Joomla before 11.0.0, rated high severity (CVSS 4.0: 7.5) with the attack requiring attacker preparation and author-level privileges. The flaw is not in CISA's KEV catalog, and no public proof of concept or observed in-the-wild exploitation is known.

What to do: Upgrade Snippets Free to version 7.0.0 or later, and Snippets Pro to version 11.0.0 or later. Audit articles authored by low-privilege users for Snippet tags containing unexpected url or variable values, and review site logs for injected script payloads. Until patched, consider restricting authoring permissions or Snippet usage to trusted users only.