Regular Labs: 24 Updates and 10 Security Fixes for Joomla Extensions

On September 13, 2026, Regular Labs simultaneously released updates for 24 Joomla extensions. Ten of these updates contain security fixes addressing nine vulnerabilities, including critical PHP code execution, several cross-site scripting vulnerabilities, and database information disclosure.

The most dangerous issue was discovered in Conditional Content Pro. The CVE-2026-85192 vulnerability allowed users with permission to create articles to execute arbitrary PHP code through inline Condition Rules. It received a score of 9.4 on the CVSS 4.0 scale — Critical severity.

The remaining vulnerabilities affect Advanced Module Manager, Articles Anywhere, Conditional Content, Content Templater, Modals, Quick Index, ReReplacer, Snippets, Tabs & Accordions, and Users Anywhere.

Which Extensions Received Security Fixes?

Security updates were released for the following extensions:

• Advanced Module Manager 12.1.0 — fixes information disclosure through Condition Set labels.
• Articles Anywhere 20.0.0 — fixes two XSS vulnerabilities.
• Conditional Content 8.0.0 — fixes PHP code execution and information disclosure.
• Content Templater 14.2.0 — fixes information disclosure through Condition Sets.
• Modals 17.0.0 — fixes two stored XSS vulnerabilities.
• Quick Index 5.0.5 — fixes XSS through index styling options.
• ReReplacer 16.2.0 — fixes information disclosure through Condition Sets.
• Snippets 11.0.0 — restricts unsafe Snippet variable overrides.
• Tabs & Accordions 3.1.0 — fixes XSS through specially crafted aliases.
• Users Anywhere 2.1.0 — fixes unsafe processing of request data.

A total of nine vulnerability identifiers were assigned to these extensions: CVE-2026-85188, CVE-2026-85189, CVE-2026-85190, CVE-2026-85191, CVE-2026-85192, CVE-2026-85195, CVE-2026-85196, CVE-2026-88852, and CVE-2026-88853.

Understanding the Threat: What Was Fixed?

PHP Code Execution in Conditional Content — CVE-2026-85192

The most dangerous vulnerability was discovered in the commercial edition of Conditional Content. The extension allows parts of an article to be displayed or hidden depending on specified conditions. Its available features include inline Condition Rules containing PHP code.

Before version 8.0.0, an insufficiently trusted user with permission to create or edit Joomla articles could add PHP code to an inline Conditional Content rule. This code would then be executed on the server when the article was processed.

Successful exploitation could result in the complete compromise of the website, including:

• reading and modifying Joomla files;
• obtaining credentials from configuration.php;
• reading or modifying the database;
• creating hidden administrator accounts;
• installing backdoors and malicious files;
• using the server to conduct further attacks.

In Conditional Content 8.0.0, PHP code execution is restricted to trusted article author groups. By default, this capability should only be available to Super Users.

The vulnerability affects Conditional Content Pro versions 7.0.0 through 7.1.0 inclusive. The fix was released in version 8.0.0.

Information Disclosure Through Condition Sets — CVE-2026-85188

The same vulnerable Condition Set mechanism was used by four Regular Labs extensions:

• Advanced Module Manager;
• Conditional Content;
• Content Templater;
• ReReplacer.

A specially crafted Condition Set label could reference unrelated database fields. As a result, a user with administrative access to create or modify Condition Sets could read information that they were not authorized to access.

This is not an unauthenticated data leak: exploitation requires access to the administrator area and permission to manage Condition Sets. Nevertheless, the issue affects several extensions because they use the same shared library and Conditions mechanism.

The following versions or later must be installed:

• Advanced Module Manager 12.1.0 — versions 12.0.0–12.0.4 are affected.
• Conditional Content 8.0.0 — versions 7.0.0–7.1.0 are affected.
• Content Templater 14.2.0 — versions 14.0.0–14.1.0 are affected.
• ReReplacer 16.2.0 — versions 16.0.0–16.1.0 are affected.

The vulnerability received a score of 6.9 on the CVSS 4.0 scale — Medium severity.

Cross-Site Scripting in Articles Anywhere — CVE-2026-85195 and CVE-2026-85196

The Articles Anywhere extension contained two separate issues that could result in JavaScript code being executed in a visitor’s or administrator’s browser.

CVE-2026-85195 is related to JavaScript Events. A user with permission to add or edit articles could attach JavaScript events to Articles Anywhere tags. This made it possible to inject a malicious script into the page content.

Such a script could be used to:

• steal data available to the current user;
• perform actions on behalf of an administrator;
• modify the page content;
• redirect visitors to a malicious website;
• display a fraudulent login form.

CVE-2026-85196 is related to data retrieved by Articles Anywhere tags from request parameters. These values were displayed without sufficient escaping, while the raw output mode was available to ordinary authors.

Two exploitation scenarios were possible: an author could save a malicious tag directly inside an article, or an attacker could send a specially crafted parameter to an existing page that already used request data in raw output mode.

The vulnerabilities affect Articles Anywhere versions 19.0.0 through 19.0.6 inclusive. They were fixed in version 20.0.0. CVE-2026-85195 received a score of 7.5 — High severity, while CVE-2026-85196 received a score of 5.3 — Medium severity.

JavaScript Links and Events in Modals — CVE-2026-85189 and CVE-2026-88853

The Modals extension also contained two stored XSS vulnerabilities.

CVE-2026-85189 allowed the javascript: protocol to be used in a modal link. When a specially crafted modal window was opened, the browser could execute the injected JavaScript code.

CVE-2026-88853 allowed any user with article editing permissions to add JavaScript Events to Modals tags. In the new version, this feature is restricted to selected article author groups.

Direct exploitation requires the ability to create or modify an article containing a Modals tag or link. The malicious code is executed in the browser of the user who opens the affected article or modal window.

Both vulnerabilities received a score of 7.5 on the CVSS 4.0 scale — High severity. Modals versions 16.0.0 through 16.2.0 inclusive are affected. The fix was released in version 17.0.0.

Variable Overrides in Snippets — CVE-2026-88852

The Snippets extension allows reusable pieces of content to be created and inserted into Joomla articles. Snippet variable values can be overridden directly inside a tag.

Before version 11.0.0, this capability was available to any user who could edit articles. If a variable value was displayed in an unsafe context, an author could inject JavaScript code that was stored in the article and executed in visitors’ browsers.

In Snippets 11.0.0, variable overrides are restricted to selected article author groups. By default, only Super Users are trusted to use this feature.

The vulnerability received a score of 7.5 — High severity. The affected range for current commercial versions is 10.0.0–10.0.6. Older free versions below 7.0.0 may also be affected, so the safest option is to update both editions directly to Snippets 11.0.0 or later.

JavaScript Injection Through Quick Index — CVE-2026-85190

The Quick Index extension did not sufficiently sanitize the CSS class options used by a generated index. A user with article editing permissions could create a specially crafted tag and inject JavaScript into the resulting page markup.

This is a stored XSS vulnerability with a score of 7.5 — High severity. It affects Quick Index versions 5.0.0 through 5.0.4 inclusive and was fixed in version 5.0.5.

The same update also resolves another issue: an index could display the titles of articles that a visitor was not authorized to access. The developer did not label this change as a separate security fix, but it prevents the disclosure of restricted article titles.

XSS Through Tabs & Accordions Aliases — CVE-2026-85191

The Tabs & Accordions extension uses the data-rlta-alias attribute to associate links with tabs and accordions. Previously, the contents of this attribute were not sanitized strictly enough.

An article author could create a specially crafted alias value that caused JavaScript code to be executed when a visitor clicked the corresponding link.

The vulnerability received a score of 7.5 — High severity. Tabs & Accordions versions 3.0.0 through 3.0.5 inclusive are affected. The fix was released in version 3.1.0.

Unsafe Data Output in Users Anywhere — CVE-2026-85196

The Users Anywhere extension used the same data tag processing mechanism as Articles Anywhere. Values obtained from request parameters could be displayed without sufficient escaping, while raw output mode was available to article authors.

This could result in stored or reflected XSS. The malicious JavaScript was executed in the browser of a user who opened the affected page or a specially crafted link, rather than on the server itself.

Users Anywhere versions 2.0.0 through 2.0.6 inclusive are affected. The fix was released in version 2.1.0. The vulnerability received a score of 5.3 — Medium severity.

Why Might Some Features Stop Working After the Update?

Four updates have been marked by the developer as BC BREAK, meaning that they contain changes that break previous behavior:

• Articles Anywhere 20.0.0;
• Conditional Content 8.0.0;
• Modals 17.0.0;
• Snippets 11.0.0.

Instead of merely escaping individual values, the developer restricted dangerous capabilities to trusted user groups:

• JavaScript Events are restricted in Articles Anywhere and Modals;
• variable overrides are restricted in Snippets;
• saving PHP code in inline rules is restricted in Conditional Content.

By default, these capabilities are only available to Super Users. Therefore, after updating, elements previously created by Editors, Managers, or other user groups may stop working or may no longer be displayed as they were before.

You should also be aware that executable parameters may no longer be processed inside modules, templates, and some third-party components, even after the appropriate user group has been authorized. For this reason, the update should preferably be tested on a staging copy of the website first.

Which Other Regular Labs Extensions Were Updated?

On the same day, Regular Labs released standard feature and maintenance updates for fourteen additional products:

• Articles Field 5.0.5;
• Better Frontend Link 2.2.11;
• Cache Cleaner 10.0.7;
• CDN for Joomla! 8.0.4;
• DB Replacer 9.1.0;
• Email Protector 6.3.12;
• Extension Manager 9.3.5;
• GeoIP 7.0.4;
• IP Login 7.0.4;
• Keyboard Shortcuts 4.0.4;
• Modules Anywhere 9.0.5;
• Sourcerer 16.0.2;
• Tooltips 10.1.0;
• What? Nothing! 19.79.4.

Although these fourteen updates are not identified as separate CVE fixes, some of them also strengthen security. For example, Cache Cleaner 10.0.7 performs stricter validation of the redirect destination after the cache is cleared, while Tooltips 10.1.0 restricts the use of JavaScript Events to selected article author groups.

Who Is at Risk?

Joomla websites running at least one of the following extensions within the affected version range are at risk:

• Advanced Module Manager 12.0.0–12.0.4;
• Articles Anywhere 19.0.0–19.0.6;
• Conditional Content 7.0.0–7.1.0;
• Content Templater 14.0.0–14.1.0;
• Modals 16.0.0–16.2.0;
• Quick Index 5.0.0–5.0.4;
• ReReplacer 16.0.0–16.1.0;
• Snippets Pro 10.0.0–10.0.6, as well as older Free versions below 7.0.0;
• Tabs & Accordions 3.0.0–3.0.5;
• Users Anywhere 2.0.0–2.0.6.

The new Regular Labs extension versions are designed for current Joomla branches, including Joomla 5 and Joomla 6. Many of them also support Joomla 4.

How to Resolve the Problem: Step-by-Step Instructions

Step 1: Create a Backup

Before performing a bulk update, create a complete backup of the Joomla files and database. Make sure the archive can be downloaded from the server and is not corrupted.

Step 2: Update All Regular Labs Extensions

1. In the Joomla administrator panel, go to System → Update → Extensions.
2. Click “Check for Updates”.
3. Find all installed Regular Labs extensions.
4. Install the available updates.
5. When the process is complete, open System → Manage → Extensions and verify the versions of all components, plugins, and packages.
6. Clear the Joomla, CDN, and browser caches.

If several Regular Labs products are installed on the website, update all of them during the same maintenance session. The shared Regular Labs Library is used by multiple extensions, and a partial update could cause compatibility problems or leave vulnerable code in another product.

Step 3: Test the Website After Updating

Pay particular attention to extensions whose updates are marked as BC BREAK:

1. Check Articles Anywhere: Open articles that use JavaScript Events, raw output, or data obtained from request parameters.
2. Check Conditional Content: Make sure existing Condition Sets still work and that saving new PHP rules is only available to trusted groups.
3. Check Modals: Test modal windows, links, event handlers, and the opening of external content.
4. Check Snippets: Find Snippets with overridable variables and make sure they are displayed correctly.
5. Check Tabs & Accordions: Test links to tabs, aliases, and accordion expansion.
6. Check Quick Index: Make sure the index does not display the titles of restricted articles.

Step 4: Check for Possible Signs of Compromise

At the time of publication, there is no confirmed evidence of widespread exploitation of the new Regular Labs vulnerabilities. However, installing the updates does not remove malicious code that may have been stored previously.

1. Check user accounts: Look for unknown users and unexpected assignments to the Author, Editor, Publisher, Manager, Administrator, and Super Users groups.
2. Check articles: Look for unfamiliar Regular Labs tags, PHP code, event attributes such as onclick, and links using the javascript: protocol.
3. Check Condition Sets: Review the Condition Sets in Advanced Module Manager, Conditional Content, Content Templater, and ReReplacer.
4. Check Snippets: Look for unexpected variables, HTML code, scripts, and changes made by unknown users.
5. Check website files: Pay particular attention to recently created or modified PHP files in the website root and in /administrator, /plugins, /modules, /templates, /images, and /media.
6. Check the logs: Preserve and analyze the Joomla, web server, and hosting control panel logs before deleting suspicious objects.

Step 5: Additional Security Measures

• Restrict Author and Editor permissions: Allow only trusted users to use PHP, JavaScript Events, raw output, and variable overrides.
• Review user self-registration: New users must not be automatically assigned to groups with article creation permissions.
• Enable multi-factor authentication for Administrators, Managers, and other privileged users.
• Update Joomla and all other extensions to their latest compatible versions.
• Remove unused extensions: Disabling an extension is not enough because its vulnerable files may remain on the server.
• Configure a Web Application Firewall: A WAF can mitigate some XSS attacks and malicious requests, but it does not replace installing the updates.
• Create regular backups and keep at least one current backup outside the website server.

We can do everything for you

If everything listed above seems too complicated, if you simply do not want to spend your time on it or if you would like to save money on expensive extensions, we are ready to help:

• update your website to the latest Joomla version together with all extensions used on it;
• audit the installed extensions and then remove those that are not being used;
• configure website backups, including backups to remote storage;
• install licensed versions of popular extensions on your website;
• protect your website from hacking by implementing additional security measures;
• take your website under our wing by regularly updating the CMS and all extensions, including commercial ones.

Submit a request List of services