Regular Labs Advanced Module Manager
Affected versions: ≤ 11.0.1
Full advisory: our disclosure post
CVE-2026-63683MediumPublished 22 July 2026
Regular Labs Advanced Module Manager (com_advancedmodules) <= 11.0.1 - Broken Access Control, Stored XSS and GeoIP Rule Bypass
Regular Labs Advanced Module Manager up to and including 11.0.1, via the bundled Conditions component and the shared Regular Labs library. Conditions administration did not consistently enforce tokens and component/mapped-item permissions (CVE-2026-63280); stored condition values could execute HTML/JavaScript in administrator summaries (CVE-2026-63281); IP and GeoIP conditions trusted spoofable forwarded headers, letting a remote client bypass location-based display rules (CVE-2026-63683); and privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens or matching permissions (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (12.0.0).
Affected versions: ≤ 11.0.1
Official record: cve.org · NVD
Related vulnerabilities
- CVE-2026-63280Regular Labs Advanced Module Manager
- CVE-2026-63281Regular Labs Advanced Module Manager
- CVE-2026-63265Regular Labs Advanced Module Manager
- CVE-2026-64792Regular Labs Conditional Content
- CVE-2026-63684Regular Labs Content Templater
- CVE-2026-62414Page Builder CK
- CVE-2026-77997YOOtheme Pro
- CVE-2024-21727DPCalendar
Every connected Joomla site is checked against these rules on each audit, and flagged if it runs an affected version.
Affected extensions and versions
Regular Labs Conditional Content - Regular Labs Conditional Content (conditionalcontent) <= 6.0.0 - Broken Access Control, Stored XSS and GeoIP Rule Bypass
Regular Labs Conditional Content up to and including 6.0.0, via the bundled Conditions component and the shared Regular Labs library. Conditions administration did not consistently enforce tokens and component/mapped-item permissions (CVE-2026-63280); stored condition values could execute HTML/JavaScript in administrator summaries (CVE-2026-63281); IP and GeoIP conditions trusted spoofable forwarded headers (CVE-2026-63683); Smart Search indexing could store restricted content in the public index (CVE-2026-64792); and the Regular Labs AJAX endpoints lacked consistent CSRF and permission checks (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (7.0.0).
Affected versions: ≤ 6.0.0
Full advisory: our disclosure post
Regular Labs Content Templater - Regular Labs Content Templater (com_contenttemplater) <= 13.0.0 - Broken Access Control and Stored XSS
Regular Labs Content Templater up to and including 13.0.0. Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks (CVE-2026-63684). Via the bundled Conditions component it is also affected by CVE-2026-63280 (missing tokens/permissions in Conditions administration), CVE-2026-63281 (stored XSS in administrator summaries) and CVE-2026-63683 (spoofable IP/GeoIP condition headers), plus CVE-2026-63265 (Regular Labs AJAX endpoints). Fixed in the Regular Labs security release of 22 July 2026 (14.0.0).
Affected versions: ≤ 13.0.0
Full advisory: our disclosure post
Our disclosure post
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 25 August 2026.