Affected versions: ≤ 18.0.2
Full advisory: regularlabs.com
CVE-2026-64795MediumCVSS 5.4Published 22 July 2026
Articles Anywhere (articlesanywhere) below 19.0.0 - SSRF, Stored XSS and Sensitive Data Exposure
Regular Labs Articles Anywhere before 19.0.0 is affected by issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): external image downloads accepting unsafe hosts, redirects, non-image responses or local download folders (SSRF); tag-provided field custom HTML overrides able to render unsafe markup (stored XSS); tag-provided ignore flags able to expose restricted or unpublished content; Smart Search indexing generated output with the indexing administrator access; and user tags, filters and conditions able to expose authentication data. Several fixes are BC breaks (field custom HTML now renders as escaped text). Update to Articles Anywhere 19.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64793, CVE-2026-64794, CVE-2026-64795, CVE-2026-64799, CVE-2026-65755.
Affected versions: ≤ 18.0.2
Official record: cve.org · NVD
Every connected Joomla site is checked against these rules on each audit, and flagged if it runs an affected version.
How CVE-2026-64795 is scored
The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
5.4 Medium
CVSS 3.1, scored by CISA-ADPCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- PR:L Privileges required
- Low. Any logged-in account will do
- UI:R User interaction
- Required. Someone has to click or visit something
- S:C Scope
- Changed. The flaw reaches past the extension it is in
What it does
- C:L Confidentiality
- Low. Some data can be read
- I:L Integrity
- Low. Some data can be altered
- A:N Availability
- None. The site stays up
The rule below is rated Critical for the set of 5 CVEs it covers together, not for this record on its own.
Affected extensions and versions
Modules Anywhere - Modules Anywhere (modulesanywhere) below 9.0.0 - Stored XSS, Access Control Bypass and Information Disclosure
Regular Labs Modules Anywhere before 9.0.0 is affected by issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): tag-provided module content and title overrides able to render unsafe markup (stored XSS); content tags able to bypass module access or publication through unapproved ignore flags or property overrides (access-control bypass); the editor popup exposing module data to unauthorized logged-in users without request token checks (information disclosure); and Smart Search indexing modules visible only to administrators. Several fixes are BC breaks (tag-provided content now renders as escaped text). Update to Modules Anywhere 9.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64793, CVE-2026-64795, CVE-2026-65757.
Affected versions: ≤ 8.4.1
Full advisory: regularlabs.com
Users Anywhere - Users Anywhere (usersanywhere) below 2.0.0 - SSRF, Stored XSS and Sensitive Data Exposure
Regular Labs Users Anywhere before 2.0.0 is affected by issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): external image downloads accepting unsafe hosts, redirects, non-image responses or local download folders (SSRF); tag-provided field custom HTML overrides able to render unsafe markup (stored XSS); and tags able to expose authentication data or restricted contact details. Several fixes are BC breaks (field custom HTML now renders as escaped text). Update to Users Anywhere 2.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64794, CVE-2026-64795, CVE-2026-64799, CVE-2026-65755.
Affected versions: ≤ 1.2.7
Full advisory: regularlabs.com
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 3 October 2026.