# CVE-2026-85195: Regular Labs Articles Anywhere stored XSS via link option

Source: https://junglewise.ai/threats/cve-2026-85195-regular-labs-articles-anywhere-stored-xss-via-link-option  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85195 · Severity: info · Published 2026-09-14

Regular Labs Articles Anywhere is a popular Joomla extension that places article content throughout websites. The extension fails to properly validate HTML event attributes (like onclick and onmouseover) in link options, allowing users with article authoring privileges to inject malicious JavaScript code. When other site visitors view pages containing these articles, the injected code executes in their browsers, potentially leading to account compromise, data theft, or malware distribution.

Technologies: [Regular Labs Articles Anywhere](https://junglewise.ai/threats/technologies/articles-anywhere). Vendors: [Regular Labs](https://junglewise.ai/threats/vendors/regular-labs).

## Quick answers

**Is CVE-2026-85195 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85195 being exploited in the wild.

**How severe is CVE-2026-85195?** Informational severity, published 14 September 2026.

**Which products and versions are affected?** Regular Labs Articles Anywhere < 20.0.0.

**Is there a fix for CVE-2026-85195?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85195 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85195?** Check whether you run Regular Labs Articles Anywhere at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in the Articles Anywhere extension's link handling. The vulnerable component accepts link options such as onclick and onmouseover without sanitization, and converts them into real HTML event attributes. The attack succeeds because the plugin syntax is processed after Joomla's standard Author content filter runs, meaning the executable HTML is generated downstream where content filtering no longer applies. An authenticated user with article authoring privileges can inject malicious JavaScript via the plugin syntax. When other users view the compromised article, the injected code executes in their browser context. The vulnerability affects versions prior to 20.0.0.

## Affected products

- Regular Labs Articles Anywhere < 20.0.0

## Timeline

- 2026-09-14: disclosed

## References

- [https://www.regularlabs.com/](https://www.regularlabs.com/)

## Related threats

- [Joomla Sourcerer PHP code injection via Articles Anywhere](https://junglewise.ai/threats/cve-2026-102802-joomla-extension-regularlabs-com-php-code-injection-vector-in)
- [Regular Labs Articles Anywhere and Users Anywhere reflected XSS](https://junglewise.ai/threats/cve-2026-85196-regular-labs-articles-anywhere-and-users-anywhere-reflected-xss)
- [Regular Labs Joomla extensions information exposure via improper caching](https://junglewise.ai/threats/cve-2026-65755-regular-labs-joomla-extensions-information-exposure-via-improper)
- [Regular Labs Joomla Extensions improper access control in user fields](https://junglewise.ai/threats/cve-2026-64794-regular-labs-joomla-extensions-improper-access-control-in-user)
- [Regular Labs Joomla extensions improper access control in content tags](https://junglewise.ai/threats/cve-2026-64793-regular-labs-joomla-extensions-improper-access-control-in-content)