# Regular Labs Content Templater (com_contenttemplater) <= 13.0.0 - Broken Access Control and Stored XSS

[Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/CVE-2026-63281

CVE-2026-63281MediumCVSS 4.8CVE published 22 July 2026Added to mySites.guru 22 July 2026

# Regular Labs Content Templater (com\_contenttemplater) <= 13.0.0 - Broken Access Control and Stored XSS

Regular Labs Content Templater up to and including 13.0.0. Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks (CVE-2026-63684). Via the bundled Conditions component it is also affected by CVE-2026-63280 (missing tokens/permissions in Conditions administration), CVE-2026-63281 (stored XSS in administrator summaries) and CVE-2026-63683 (spoofable IP/GeoIP condition headers), plus CVE-2026-63265 (Regular Labs AJAX endpoints). Fixed in the Regular Labs security release of 22 July 2026 (14.0.0).

Copy citation

## Is my site affected?

CVE-2026-63281 is checked by 4 rules. Find the extension and release line your site runs:

Extension

Affected versions

Fixed in

What to do

[Content Templater](https://mysites.guru/vulnerabilities/contenttemplater/)

up to and including 13.0.0

after 13.0.0

Update Content Templater to the newest release from the vendor. This flaw covers versions up to 13.0.0, so any later release is outside it.

[Advanced Module Manager](https://mysites.guru/vulnerabilities/advancedmodules/)

up to and including 11.0.1

after 11.0.1

Update Advanced Module Manager to the newest release from the vendor. This flaw covers versions up to 11.0.1, so any later release is outside it.

[ReReplacer](https://mysites.guru/vulnerabilities/rereplacer/)

up to and including 15.0.3

after 15.0.3

Update ReReplacer to the newest release from the vendor. This flaw covers versions up to 15.0.3, so any later release is outside it.

[Conditional Content](https://mysites.guru/vulnerabilities/conditionalcontent/)

up to and including 6.0.0

after 6.0.0

Update Conditional Content to the newest release from the vendor. This flaw covers versions up to 6.0.0, so any later release is outside it.

[Check whether your sites are affected](https://mysites.guru/free-audit/)

## How CVE-2026-63281 is scored

The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

4.8 Medium

CVSS 3.1, scored by CISA-ADP

`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N`

### How it is reached

- **AV:N Attack vector** - Network. Reachable across the internet
- **AC:L Attack complexity** - Low. Nothing to work around, it just works
- **PR:H Privileges required** - High. Needs an account with elevated rights
- **UI:R User interaction** - Required. Someone has to click or visit something
- **S:C Scope** - Changed. The flaw reaches past the extension it is in

### What it does

- **C:L Confidentiality** - Low. Some data can be read
- **I:L Integrity** - Low. Some data can be altered
- **A:N Availability** - None. The site stays up

## Timeline

1.  22 July 2026CVE-2026-63281 record published by its CNA
2.  22 July 2026mySites.guru check added for Content Templater (up to and including 13.0.0)
3.  22 July 2026mySites.guru check added for Advanced Module Manager (up to and including 11.0.1)
4.  22 July 2026mySites.guru check added for ReReplacer (up to and including 15.0.3)
5.  22 July 2026mySites.guru check added for Conditional Content (up to and including 6.0.0)
6.  22 July 2026[We published: Regular Labs Patched Its Whole Joomla Extension Catalogue at Once](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/)

## Rule details

Medium[CVE-2026-63684](https://mysites.guru/vulnerabilities/CVE-2026-63684/)[CVE-2026-63280](https://mysites.guru/vulnerabilities/CVE-2026-63280/)[CVE-2026-63281](https://mysites.guru/vulnerabilities/CVE-2026-63281/)[CVE-2026-63683](https://mysites.guru/vulnerabilities/CVE-2026-63683/)2026-07-22

[Content Templater](https://mysites.guru/vulnerabilities/contenttemplater/)

Affected versions: ≤ 13.0.0

Full advisory: [our disclosure post](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/)

Medium[CVE-2026-63280](https://mysites.guru/vulnerabilities/CVE-2026-63280/)[CVE-2026-63281](https://mysites.guru/vulnerabilities/CVE-2026-63281/)[CVE-2026-63683](https://mysites.guru/vulnerabilities/CVE-2026-63683/)[CVE-2026-63265](https://mysites.guru/vulnerabilities/CVE-2026-63265/)2026-07-22

[Advanced Module Manager](https://mysites.guru/vulnerabilities/advancedmodules/) - Regular Labs Advanced Module Manager (com\_advancedmodules) <= 11.0.1 - Broken Access Control, Stored XSS and GeoIP Rule Bypass

Regular Labs Advanced Module Manager up to and including 11.0.1, via the bundled Conditions component and the shared Regular Labs library. Conditions administration did not consistently enforce tokens and component/mapped-item permissions (CVE-2026-63280); stored condition values could execute HTML/JavaScript in administrator summaries (CVE-2026-63281); IP and GeoIP conditions trusted spoofable forwarded headers, letting a remote client bypass location-based display rules (CVE-2026-63683); and privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens or matching permissions (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (12.0.0).

Affected versions: ≤ 11.0.1

Full advisory: [our disclosure post](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/)

Medium[CVE-2026-65754](https://mysites.guru/vulnerabilities/CVE-2026-65754/)[CVE-2026-63684](https://mysites.guru/vulnerabilities/CVE-2026-63684/)[CVE-2026-63280](https://mysites.guru/vulnerabilities/CVE-2026-63280/)[CVE-2026-63281](https://mysites.guru/vulnerabilities/CVE-2026-63281/)2026-07-22

[ReReplacer](https://mysites.guru/vulnerabilities/rereplacer/) - Regular Labs ReReplacer (com\_rereplacer) <= 15.0.3 - Path Traversal, Broken Access Control and Stored XSS

Regular Labs ReReplacer up to and including 15.0.3. ReReplacer XML include paths could read files outside the site directory (CVE-2026-65754). Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks (CVE-2026-63684). Via the bundled Conditions component it is also affected by CVE-2026-63280 (missing tokens/permissions in Conditions administration), CVE-2026-63281 (stored XSS in administrator summaries) and CVE-2026-63683 (spoofable IP/GeoIP condition headers), plus CVE-2026-64792 (Smart Search indexing rendering restricted content as the indexing administrator) and CVE-2026-63265 (Regular Labs AJAX endpoints). Fixed in the Regular Labs security release of 22 July 2026 (16.0.0).

Affected versions: ≤ 15.0.3

Full advisory: [our disclosure post](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/)

Medium[CVE-2026-63280](https://mysites.guru/vulnerabilities/CVE-2026-63280/)[CVE-2026-63281](https://mysites.guru/vulnerabilities/CVE-2026-63281/)[CVE-2026-63683](https://mysites.guru/vulnerabilities/CVE-2026-63683/)[CVE-2026-64792](https://mysites.guru/vulnerabilities/CVE-2026-64792/)2026-07-22

[Conditional Content](https://mysites.guru/vulnerabilities/conditionalcontent/) - Regular Labs Conditional Content (conditionalcontent) <= 6.0.0 - Broken Access Control, Stored XSS and GeoIP Rule Bypass

Regular Labs Conditional Content up to and including 6.0.0, via the bundled Conditions component and the shared Regular Labs library. Conditions administration did not consistently enforce tokens and component/mapped-item permissions (CVE-2026-63280); stored condition values could execute HTML/JavaScript in administrator summaries (CVE-2026-63281); IP and GeoIP conditions trusted spoofable forwarded headers (CVE-2026-63683); Smart Search indexing could store restricted content in the public index (CVE-2026-64792); and the Regular Labs AJAX endpoints lacked consistent CSRF and permission checks (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (7.0.0).

Affected versions: ≤ 6.0.0

Full advisory: [our disclosure post](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/)

## Our disclosure post

[![Regular Labs Patched Its Whole Joomla Extension Catalogue at Once](https://mysites.guru/_astro/regular-labs-joomla-extension-security-release.BEGGx_Zx_mOFLY.webp)

### Regular Labs Patched Its Whole Joomla Extension Catalogue at Once

Regular Labs shipped a security-hardening update across its Joomla extension range on 22 July 2026: SSRF, command injection, stored XSS and more. No CVEs.

22 Jul 2026

](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/)

## Other vulnerabilities in Content Templater, Advanced Module Manager, ReReplacer and Conditional Content

Updating for CVE-2026-63281 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extensions.

### [Content Templater](https://mysites.guru/vulnerabilities/contenttemplater/)

Latest safe version: 14.2.0

-   [CVE-2026-85188](https://mysites.guru/vulnerabilities/CVE-2026-85188/) Medium, from 14.0.0 up to but not including 14.2.0
-   [CVE-2026-63684](https://mysites.guru/vulnerabilities/CVE-2026-63684/) Medium, up to and including 13.0.0
-   [CVE-2026-63280](https://mysites.guru/vulnerabilities/CVE-2026-63280/) Medium, up to and including 13.0.0
-   [CVE-2026-63683](https://mysites.guru/vulnerabilities/CVE-2026-63683/) Medium, up to and including 13.0.0

### [Advanced Module Manager](https://mysites.guru/vulnerabilities/advancedmodules/)

Latest safe version: 12.1.0

-   [CVE-2026-85188](https://mysites.guru/vulnerabilities/CVE-2026-85188/) Medium, from 12.0.0 up to but not including 12.1.0
-   [CVE-2026-63280](https://mysites.guru/vulnerabilities/CVE-2026-63280/) Medium, up to and including 11.0.1
-   [CVE-2026-63683](https://mysites.guru/vulnerabilities/CVE-2026-63683/) Medium, up to and including 11.0.1
-   [CVE-2026-63265](https://mysites.guru/vulnerabilities/CVE-2026-63265/) Medium, up to and including 11.0.1

### [ReReplacer](https://mysites.guru/vulnerabilities/rereplacer/)

Latest safe version: 16.2.0

-   [CVE-2026-85188](https://mysites.guru/vulnerabilities/CVE-2026-85188/) Medium, from 16.0.0 up to but not including 16.2.0
-   [CVE-2026-65754](https://mysites.guru/vulnerabilities/CVE-2026-65754/) Medium, up to and including 15.0.3
-   [CVE-2026-63684](https://mysites.guru/vulnerabilities/CVE-2026-63684/) Medium, up to and including 15.0.3
-   [CVE-2026-63280](https://mysites.guru/vulnerabilities/CVE-2026-63280/) Medium, up to and including 15.0.3

### [Conditional Content](https://mysites.guru/vulnerabilities/conditionalcontent/)

Latest safe version: 8.0.0

-   [CVE-2026-85192](https://mysites.guru/vulnerabilities/CVE-2026-85192/) Critical, from 7.0.0 up to but not including 8.0.0
-   [CVE-2026-85188](https://mysites.guru/vulnerabilities/CVE-2026-85188/) Critical, from 7.0.0 up to but not including 8.0.0
-   [CVE-2026-63280](https://mysites.guru/vulnerabilities/CVE-2026-63280/) Medium, up to and including 6.0.0
-   [CVE-2026-63683](https://mysites.guru/vulnerabilities/CVE-2026-63683/) Medium, up to and including 6.0.0
-   [CVE-2026-64792](https://mysites.guru/vulnerabilities/CVE-2026-64792/) Medium, up to and including 6.0.0

## References

-   [CVE-2026-63281 on cve.org (the official CVE record)](https://www.cve.org/CVERecord?id=CVE-2026-63281)
-   [CVE-2026-63281 in the NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-63281)
-   [Regular Labs Patched Its Whole Joomla Extension Catalogue at Once](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/)

## CVE-2026-63281 questions

Show all

Which versions are affected by CVE-2026-63281?

[CVE-2026-63281](https://mysites.guru/vulnerabilities/CVE-2026-63281/) is covered by 4 rules: Content Templater up to and including 13.0.0; Advanced Module Manager up to and including 11.0.1; ReReplacer up to and including 15.0.3; Conditional Content up to and including 6.0.0.

How do I fix CVE-2026-63281?

It depends on the extension and release line your site runs. For Content Templater up to and including 13.0.0: update Content Templater to the newest release from the vendor. This flaw covers versions up to 13.0.0, so any later release is outside it. For Advanced Module Manager up to and including 11.0.1: update Advanced Module Manager to the newest release from the vendor. This flaw covers versions up to 11.0.1, so any later release is outside it. For ReReplacer up to and including 15.0.3: update ReReplacer to the newest release from the vendor. This flaw covers versions up to 15.0.3, so any later release is outside it. For Conditional Content up to and including 6.0.0: update Conditional Content to the newest release from the vendor. This flaw covers versions up to 6.0.0, so any later release is outside it.

How severe is CVE-2026-63281?

CISA-ADP scores it 4.8 (Medium) under CVSS 3.1. In plain terms: reachable across the internet, needs an account with elevated rights and someone has to click or visit something.

## Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day.

This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/).

Rules current as of 14 October 2026.