Executive brief
Regular Labs Articles Anywhere is a popular Joomla extension that places article content throughout websites. The extension fails to properly validate HTML event attributes (like onclick and onmouseover) in link options, allowing users with article authoring privileges to inject malicious JavaScript code. When other site visitors view pages containing these articles, the injected code executes in their browsers, potentially leading to account compromise, data theft, or malware distribution.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Articles Anywhere extension's link handling. The vulnerable component accepts link options such as onclick and onmouseover without sanitization, and converts them into real HTML event attributes. The attack succeeds because the plugin syntax is processed after Joomla's standard Author content filter runs, meaning the executable HTML is generated downstream where content filtering no longer applies. An authenticated user with article authoring privileges can inject malicious JavaScript via the plugin syntax. When other users view the compromised article, the injected code executes in their browser context. The vulnerability affects versions prior to 20.0.0.
Affected products
- Regular Labs Articles Anywhere < 20.0.0
Timeline
- 2026-09-14: disclosed