Regularlabs.Com
Vulnerability activity for Regularlabs.Com: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 12
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 13
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 8.9HighNov 2, 2026Regularlabs.Com Sourcerer Free extension for Joomla Code / command injectionCVE-2026-102802Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere can insert the text or full layout of one article into another. In the affected combination, when Articles Anywhere processes an inclusion before Sourcerer and Force Content Triggers is off, the includ
- 5.1MediumNov 2, 2026Regularlabs.Com Users Anywhere (Free, Pro) extension for Joomla Information disclosureCVE-2026-102801Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1 - An administrator can disable output of user email addresses or usernames in Users Anywhere. In affected code, attributes supplied inside a {user} or [email] / [username] tag can change those plugin settings for that render. For example, [email allow_output_email="1"] can display an email address even when Allow output of email is set to No. This bypasses t
- 7.5HighSep 14, 2026Regularlabs.Com Modals (Pro) extension for Joomla XSSCVE-2026-88853Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0 - Modals Pro intentionally supports JavaScript Events such as on-open and on-closed. Affected versions do not distinguish trusted extension configuration from event code supplied in ordinary article content. A lower-privileged author can therefore use a documented executable feature which should be reserved for trusted authors.
- 7.5HighSep 14, 2026Regularlabs.Com Snippets (Free) extension for Joomla XSSCVE-2026-88852Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.0 - Snippets substitutes variable values supplied by an article tag into saved Snippet content. The affected versions do not consider the article author's trust level. A lower-privileged author can therefore place an unsafe value into a security-sensitive position chosen by the trusted Snippet author.
- 5.3MediumSep 14, 2026Regularlabs.Com Articles Anywhere (Pro) extension for Joomla XSSCVE-2026-85196Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return values from request-input data tags without making them safe for the context in which the tag is used. Joomla's string input filter does not make the same value safe for HTML text, an HTML attribute and a URL. A visitor-controlled request value can therefore become an executable URL or a new event
- 7.5HighSep 14, 2026Regularlabs.Com Articles Anywhere (Free, Pro) extension for Joomla XSSCVE-2026-85195Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0 - Articles Anywhere accepts link options such as onclick and onmouseover. In affected versions, those options become real HTML event attributes without checking the article author's trust level. The plugin syntax survives Joomla's normal Author content filter because the executable HTML is generated later.
- 9.4CriticalSep 14, 2026Regularlabs.Com Conditional Content Pro extension for Joomla Code / command injectionCVE-2026-85192Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0 - Conditional Content Pro accepts inline PHP Condition Rules in article syntax. In affected versions, the PHP is passed to the Conditions evaluator without checking who authored the article. Joomla's normal Author text filter preserves the syntax, so publishing the article causes the code to run as the web-server process.
- 7.5HighSep 14, 2026Regularlabs.Com Tabs & Accordions (Free, Pro) extension for Joomla XSSCVE-2026-85191Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0 - Tabs & Accordions rewrites links matching an item alias into calls to its browser API. The affected renderer places the alias inside a quoted JavaScript argument in an HTML onclick attribute without securing both the JavaScript-string and HTML-attribute contexts. A crafted data-rlta-alias value can therefore change the generated handler.
- 7.5HighSep 14, 2026Regularlabs.Com Quick Index (Free, Pro) extension for Joomla XSSCVE-2026-85190Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5 - Quick Index inserts configurable class values into generated HTML without escaping them for an HTML attribute. A crafted value can close the intended class attribute and introduce a new attribute. Joomla's content filter cannot reliably prevent this because Quick Index creates the executable HTML after the authored plugin syntax was filtered.
- 7.5HighSep 14, 2026Regularlabs.Com Modals (Free, Pro) extension for Joomla XSSCVE-2026-85189Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0 - Modals treats a destination using an executable browser URL scheme as an ordinary modal URL. The value can reach both the generated link and the iframe-loading path. Authored content can consequently become JavaScript in a visitor's browser without using Modals' separate Pro JavaScript Events feature.
- 6.9MediumSep 14, 2026Regularlabs.Com Advanced Module Manager (Free, Pro) extension for Joomla Information disclosureCVE-2026-85188Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) < 12.1.0, Conditional Content (Free, Pro) < 8.0.0, Content Templater (Pro) < 14.2.0, ReReplacer (Pro) < 16.2.0 for Joomla - The Conditions editor creates a default Condition Set name from the item to which the set is linked. The affected code accepts the database table and label-column names from the request. Although these names are quoted as SQL identifiers, they are not restricted to the table
- 10.0CriticalAug 17, 2026Regularlabs.Com Sourcerer extension for Joomla Code / command injectionCVE-2026-74253Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0 - Regular Labs Sourcerer before 16.0.0 processes {source} blocks found in Joomla’s final rendered HTML without reliably determining where that code originated.
- 8.0HighJul 22, 2026Regularlabs.Com Advanced Module Manager extension for Joomla Auth bypass / access controlCVE-2026-63265Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization.
Top products
- Users Anywhere (Free, Pro) extension for Joomla1 CVE in the last year
- Tabs & Accordions (Free, Pro) extension for Joomla1 CVE in the last year
- Sourcerer Free extension for Joomla1 CVE in the last year
- Sourcerer extension for Joomla1 CVE in the last year, 1 critical
- Snippets (Free) extension for Joomla1 CVE in the last year
- Quick Index (Free, Pro) extension for Joomla1 CVE in the last year
- Modals (Pro) extension for Joomla1 CVE in the last year
- Modals (Free, Pro) extension for Joomla1 CVE in the last year
- Conditional Content Pro extension for Joomla1 CVE in the last year, 1 critical
- Articles Anywhere (Pro) extension for Joomla1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.