Regular Labs GeoIP (geoip) <= 6.3.8 - Zipslip Arbitrary File Write (RCE), CSRF and Privilege Check Bypass, MaxMind Credential Leakage and IP Spoofing

Regular Labs GeoIP

Affected versions: ≤ 6.3.8

Full advisory: regularlabs.com

Articles Anywhere - Articles Anywhere (articlesanywhere) below 19.0.0 - SSRF, Stored XSS and Sensitive Data Exposure

Regular Labs Articles Anywhere before 19.0.0 is affected by issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): external image downloads accepting unsafe hosts, redirects, non-image responses or local download folders (SSRF); tag-provided field custom HTML overrides able to render unsafe markup (stored XSS); tag-provided ignore flags able to expose restricted or unpublished content; Smart Search indexing generated output with the indexing administrator access; and user tags, filters and conditions able to expose authentication data. Several fixes are BC breaks (field custom HTML now renders as escaped text). Update to Articles Anywhere 19.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64793, CVE-2026-64794, CVE-2026-64795, CVE-2026-64799, CVE-2026-65755.

Affected versions: ≤ 18.0.2

Full advisory: regularlabs.com

Sourcerer - Sourcerer (sourcerer) below 13.0.0 - Code Execution (CVE-2025-22204) and PHP/Script Privilege Escalation

Regular Labs Sourcerer is affected by two lines of security issue. (1) CVE-2025-22204: improper control of code generation leading to code execution in versions before 11.0.0. (2) The coordinated Regular Labs security release of 22 July 2026 (Sourcerer 13.0.0) restricts PHP in articles to content created and last modified by Super Users, enforces the configured CSS/JavaScript/PHP permissions across tags, attributes, files and both article creators and modifiers, restricts PHP includes to the configured include folder, and fixes script/style security checks that missed executable tag variants - collectively a set of privilege-escalation and code/markup-execution hardening fixes. No CVE was assigned to the 22 July issues. Update to Sourcerer 13.0.0 or later. Note: 13.0.0 preserves your existing Pro security settings on update, so review them to opt into the new stricter defaults. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64796. Sites on this version range are ALSO within the affected range of CVE-2026-74253 (Sourcerer before 16.0.0, CVSS 4.0 10.0 Critical, unauthenticated remote code execution through unverified reflected code, CWE-94, credited to Lukasz Rybak), whose CNA record was re-scoped on 26 August 2026 and now covers 1.0.0 to 15.0.0. Updating to 13.0.0 is therefore no longer sufficient, and neither is 14.x or 15.0.0: the vendor fix for CVE-2026-74253 was incomplete twice and only Sourcerer 16.0.0 (26 August 2026) resolves it. Update to 16.0.0 or later. The Joomla Security Strike Team confirmed active exploitation in the wild from around 19 August 2026. If you cannot update immediately, disable the Sourcerer system plugin, which is the plugin that renders Sourcerer tags.

Affected versions: ≤ 12.2.8

Full advisory: regularlabs.com

Modules Anywhere - Modules Anywhere (modulesanywhere) below 9.0.0 - Stored XSS, Access Control Bypass and Information Disclosure

Regular Labs Modules Anywhere before 9.0.0 is affected by issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): tag-provided module content and title overrides able to render unsafe markup (stored XSS); content tags able to bypass module access or publication through unapproved ignore flags or property overrides (access-control bypass); the editor popup exposing module data to unauthorized logged-in users without request token checks (information disclosure); and Smart Search indexing modules visible only to administrators. Several fixes are BC breaks (tag-provided content now renders as escaped text). Update to Modules Anywhere 9.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64793, CVE-2026-64795, CVE-2026-65757.

Affected versions: ≤ 8.4.1

Full advisory: regularlabs.com

Cache Cleaner - Cache Cleaner (cachecleaner) below 10.0.0 - Authenticated SSRF, OS Command Injection and Path Traversal

Regular Labs Cache Cleaner before 10.0.0 is affected by several issues fixed in the coordinated Regular Labs security release of 22 July 2026: custom query URLs able to reach private or reserved network services (SSRF); SiteGround cache purging that let request host values reach a shell command (OS command injection); custom folder and log paths accepting unsafe relative paths (path traversal); CDN provider credentials exposed in administrator request URLs; and administrator URL purges not requiring a valid token and cache-manage permission. Exploitation is largely from configured/administrator context, but the SSRF and command-injection paths are the notable ones. Update to Cache Cleaner 10.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64871, CVE-2026-64872, CVE-2026-64873, CVE-2026-64874.

Affected versions: < 10.0.0

Full advisory: regularlabs.com

Users Anywhere - Users Anywhere (usersanywhere) below 2.0.0 - SSRF, Stored XSS and Sensitive Data Exposure

Regular Labs Users Anywhere before 2.0.0 is affected by issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): external image downloads accepting unsafe hosts, redirects, non-image responses or local download folders (SSRF); tag-provided field custom HTML overrides able to render unsafe markup (stored XSS); and tags able to expose authentication data or restricted contact details. Several fixes are BC breaks (field custom HTML now renders as escaped text). Update to Users Anywhere 2.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64794, CVE-2026-64795, CVE-2026-64799, CVE-2026-65755.

Affected versions: ≤ 1.2.7

Full advisory: regularlabs.com

Regular Labs DB Replacer - Regular Labs DB Replacer (com_dbreplacer) <= 8.2.7 - Broken Access Control (unauthorised database replacements)

Regular Labs DB Replacer up to and including 8.2.7. Administrator routes and replacement requests did not consistently require Super User permission and a valid token, so an unauthorised backend user or a CSRF attack could run database replacements across the site - potentially causing major data corruption or full site compromise. Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Fixed in the Regular Labs security release of 22 July 2026 (9.0.0).

Affected versions: ≤ 8.2.7

Full advisory: our disclosure post

Regular Labs IP Login - Regular Labs IP Login (iplogin) <= 6.2.5 - Client-IP Spoofing and Weak Login Key Entropy (account impersonation)

Regular Labs IP Login up to and including 6.2.5. IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy, so an attacker could spoof the IP used for automatic login and impersonate the mapped account (CVE-2026-64797). Persistent URL login keys were also generated with a non-cryptographic random generator with insufficient entropy, making them guessable (CVE-2026-64798). Also affected by CVE-2026-63265. Fixed in the Regular Labs security release of 22 July 2026 (7.0.0).

Affected versions: ≤ 6.2.5

Full advisory: our disclosure post

Regular Labs Extension Manager - Regular Labs Extension Manager (com_regularlabsmanager) <= 9.2.5 - Broken Access Control (unauthorised extension install/update/uninstall)

Regular Labs Extension Manager up to and including 9.2.5. Administrator routes and the install/update/uninstall processing did not consistently enforce component-management and installation permissions, so an unauthorised backend user, or a CSRF attack against a logged-in administrator, could install, update or remove Joomla extensions - which is a site takeover primitive. Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Fixed in the Regular Labs security release of 22 July 2026 (9.3.0). Update via Joomla Update or the Regular Labs Extension Manager.

Affected versions: ≤ 9.2.5

Full advisory: our disclosure post

Snippets - Regular Labs Snippets (com_snippets) <= 9.3.10 - Broken Access Control and Search Index Content Disclosure

Regular Labs Snippets up to and including 9.3.10. Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks, so unauthorised backend users or a CSRF attack could expose, create or modify extension configuration and items (CVE-2026-63684). Smart Search indexing could also store restricted content in the public search index (CVE-2026-64792), and the shared Regular Labs AJAX endpoints lacked consistent CSRF and permission checks (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (10.0.0). Note this rule matches the com_snippets component deliberately: the plugin element "snippets" is also used by the unrelated "Page Builder CK - Snippets" plugin.

Affected versions: ≤ 9.3.10

Full advisory: our disclosure post

Content Templater - Regular Labs Content Templater (com_contenttemplater) <= 13.0.0 - Broken Access Control and Stored XSS

Regular Labs Content Templater up to and including 13.0.0. Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks (CVE-2026-63684). Via the bundled Conditions component it is also affected by CVE-2026-63280 (missing tokens/permissions in Conditions administration), CVE-2026-63281 (stored XSS in administrator summaries) and CVE-2026-63683 (spoofable IP/GeoIP condition headers), plus CVE-2026-63265 (Regular Labs AJAX endpoints). Fixed in the Regular Labs security release of 22 July 2026 (14.0.0).

Affected versions: ≤ 13.0.0

Full advisory: our disclosure post

Tabs & Accordions - Regular Labs Tabs & Accordions (tabsaccordions) <= 2.5.6 - Access Control and Search Index Content Disclosure

Regular Labs Tabs & Accordions up to and including 2.5.6. Smart Search indexing could render generated content using the indexing administrator identity instead of a public guest, so restricted or administrator-only content could be stored in the public search index and disclosed to visitors (CVE-2026-64792). Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Fixed in the Regular Labs security release of 22 July 2026 (3.0.0).

Affected versions: ≤ 2.5.6

Full advisory: our disclosure post

Advanced Module Manager - Regular Labs Advanced Module Manager (com_advancedmodules) <= 11.0.1 - Broken Access Control, Stored XSS and GeoIP Rule Bypass

Regular Labs Advanced Module Manager up to and including 11.0.1, via the bundled Conditions component and the shared Regular Labs library. Conditions administration did not consistently enforce tokens and component/mapped-item permissions (CVE-2026-63280); stored condition values could execute HTML/JavaScript in administrator summaries (CVE-2026-63281); IP and GeoIP conditions trusted spoofable forwarded headers, letting a remote client bypass location-based display rules (CVE-2026-63683); and privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens or matching permissions (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (12.0.0).

Affected versions: ≤ 11.0.1

Full advisory: our disclosure post

ReReplacer - Regular Labs ReReplacer (com_rereplacer) <= 15.0.3 - Path Traversal, Broken Access Control and Stored XSS

Regular Labs ReReplacer up to and including 15.0.3. ReReplacer XML include paths could read files outside the site directory (CVE-2026-65754). Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks (CVE-2026-63684). Via the bundled Conditions component it is also affected by CVE-2026-63280 (missing tokens/permissions in Conditions administration), CVE-2026-63281 (stored XSS in administrator summaries) and CVE-2026-63683 (spoofable IP/GeoIP condition headers), plus CVE-2026-64792 (Smart Search indexing rendering restricted content as the indexing administrator) and CVE-2026-63265 (Regular Labs AJAX endpoints). Fixed in the Regular Labs security release of 22 July 2026 (16.0.0).

Affected versions: ≤ 15.0.3

Full advisory: our disclosure post

Conditional Content - Regular Labs Conditional Content (conditionalcontent) <= 6.0.0 - Broken Access Control, Stored XSS and GeoIP Rule Bypass

Regular Labs Conditional Content up to and including 6.0.0, via the bundled Conditions component and the shared Regular Labs library. Conditions administration did not consistently enforce tokens and component/mapped-item permissions (CVE-2026-63280); stored condition values could execute HTML/JavaScript in administrator summaries (CVE-2026-63281); IP and GeoIP conditions trusted spoofable forwarded headers (CVE-2026-63683); Smart Search indexing could store restricted content in the public index (CVE-2026-64792); and the Regular Labs AJAX endpoints lacked consistent CSRF and permission checks (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (7.0.0).

Affected versions: ≤ 6.0.0

Full advisory: our disclosure post

Modals - Modals (modals) below 16.0.0 - Stored XSS and Path Traversal

Regular Labs Modals before 16.0.0 is affected by issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): decoded modal data title, description and HTML values able to execute unsafe markup (stored XSS - decoded modal HTML now strips scripts, event handlers and executable URLs); and (Pro) gallery folders accepting unsafe relative paths (path traversal). Update to Modals 16.0.0 or later (16.0.1 is a same-day bugfix follow-up). CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64795, CVE-2026-65713.

Affected versions: ≤ 15.0.0

Full advisory: regularlabs.com

Quick Index - Regular Labs Quick Index (quickindex) <= 4.3.6 - Broken Access Control (Regular Labs AJAX endpoints)

Regular Labs Quick Index up to and including 4.3.6. Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration, so authenticated lower-privileged users, or a CSRF attack, could invoke lookups or mutations outside their authorisation (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (5.0.0).

Affected versions: ≤ 4.3.6

Full advisory: our disclosure post

Regular Labs Better Frontend Link - Regular Labs Better Frontend Link (mod_betterfrontendlink) <= 2.2.5 - Broken Access Control

Regular Labs Better Frontend Link up to and including 2.2.5. Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (2.2.6).

Affected versions: ≤ 2.2.5

Full advisory: our disclosure post

Regular Labs CDN - Regular Labs CDN for Joomla (cdnforjoomla) <= 7.3.7 - Path Traversal and Credential Exposure

Regular Labs CDN for Joomla up to and including 7.3.7. CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata (CVE-2026-65712). Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Note the related Cache Cleaner issue CVE-2026-64874, where CDN credentials were exposed in administrator request URLs, is covered by the Cache Cleaner rule. Fixed in the Regular Labs security release of 22 July 2026 (8.0.0).

Affected versions: ≤ 7.3.7

Full advisory: our disclosure post

Regular Labs Email Protector - Regular Labs Email Protector (emailprotector) <= 6.3.7 - Broken Access Control (Regular Labs AJAX endpoints)

Regular Labs Email Protector up to and including 6.3.7. Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration, so authenticated lower-privileged users, or a CSRF attack, could invoke lookups or mutations outside their authorisation (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (6.3.8).

Affected versions: ≤ 6.3.7

Full advisory: our disclosure post

Keyboard Shortcuts - Keyboard Shortcuts (keyboardshortcuts) below 4.0.0 - Authenticated JavaScript Injection (Stored XSS)

Regular Labs Keyboard Shortcuts before 4.0.0 is affected by an issue fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): custom shortcut action overrides accepting arbitrary inline JavaScript (a BC break now restricts overrides to Joomla tasks, approved helpers and constrained administrator redirects), plus privileged AJAX endpoints not consistently enforcing valid tokens and permissions. Shortcuts are administrator-configured, so exploitation is authenticated, but a lower-privileged or compromised admin could inject persistent JavaScript. Update to Keyboard Shortcuts 4.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-65756.

Affected versions: ≤ 3.2.5

Full advisory: regularlabs.com

Regular Labs What? Nothing! - Regular Labs What? Nothing! (whatnothing) <= 17.2.5 - Broken Access Control (Regular Labs AJAX endpoints)

Regular Labs What? Nothing! up to and including 17.2.5. Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration, so authenticated lower-privileged users, or a CSRF attack, could invoke lookups or mutations outside their authorisation (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026.

Affected versions: ≤ 17.2.5

Full advisory: our disclosure post

Tooltips - Tooltips (tooltips) below 10.0.0 - Stored XSS

Regular Labs Tooltips before 10.0.0 is affected by an issue fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): decoded tooltip data title and content values able to execute unsafe markup (stored XSS - decoded tooltip HTML now strips scripts, event handlers and executable URLs), plus privileged AJAX endpoints not consistently enforcing valid tokens and permissions. Update to Tooltips 10.0.0 or later (10.0.1 is a same-day bugfix follow-up). CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64795.

Affected versions: ≤ 9.4.7

Full advisory: regularlabs.com