CriticalCVE-2026-64793CVE-2026-64794CVE-2026-64795CVE-2026-64799CVE-2026-65755CVE-2026-63265CVE-2026-647922026-07-22
Affected versions: ≤ 18.0.2
Full advisory: regularlabs.com
CVE-2026-64795MediumCVSS 5.4CVE published 22 July 2026Added to mySites.guru 22 July 2026
Articles Anywhere (articlesanywhere) below 19.0.0 - SSRF, Stored XSS and Sensitive Data Exposure
Regular Labs Articles Anywhere before 19.0.0 is affected by issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): external image downloads accepting unsafe hosts, redirects, non-image responses or local download folders (SSRF); tag-provided field custom HTML overrides able to render unsafe markup (stored XSS); tag-provided ignore flags able to expose restricted or unpublished content; Smart Search indexing generated output with the indexing administrator access; and user tags, filters and conditions able to expose authentication data. Several fixes are BC breaks (field custom HTML now renders as escaped text). Update to Articles Anywhere 19.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64793, CVE-2026-64794, CVE-2026-64795, CVE-2026-64799, CVE-2026-65755.
Is my site affected?
CVE-2026-64795 is checked by 5 rules. Find the extension and release line your site runs:
| Extension | Affected versions | Fixed in | What to do |
|---|---|---|---|
| Articles Anywhere | up to and including 18.0.2 | update to 19.0.0 | Update Articles Anywhere to 19.0.0 for this flaw, or to 20.1.1 or later, which no rule we check matches. |
| Modules Anywhere | up to and including 8.4.1 | update to 9.0.0 | Update Modules Anywhere to 9.0.0 for this flaw, or to 10.0.0 or later, which no rule we check matches. |
| Users Anywhere | up to and including 1.2.7 | update to 2.0.0 | Update Users Anywhere to 2.0.0 for this flaw, or to 3.0.1 or later, which no rule we check matches. |
| Modals | up to and including 15.0.0 | update to 16.0.0 | Update Modals to 16.0.0 for this flaw, or to 17.0.0 or later, which no rule we check matches. |
| Tooltips | up to and including 9.4.7 | update to 10.0.0 | Update Tooltips to 10.0.0 or later. |
How CVE-2026-64795 is scored
The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
5.4 Medium
CVSS 3.1, scored by CISA-ADPCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- PR:L Privileges required
- Low. Any logged-in account will do
- UI:R User interaction
- Required. Someone has to click or visit something
- S:C Scope
- Changed. The flaw reaches past the extension it is in
What it does
- C:L Confidentiality
- Low. Some data can be read
- I:L Integrity
- Low. Some data can be altered
- A:N Availability
- None. The site stays up
The rule below is rated Critical for the set of 7 CVEs it covers together, not for this record on its own.
Timeline
- 22 July 2026CVE-2026-64795 record published by its CNA
- 22 July 2026mySites.guru check added for Articles Anywhere (up to and including 18.0.2)
- 22 July 2026mySites.guru check added for Modules Anywhere (up to and including 8.4.1)
- 22 July 2026mySites.guru check added for Users Anywhere (up to and including 1.2.7)
- 22 July 2026mySites.guru check added for Modals (up to and including 15.0.0)
- 22 July 2026mySites.guru check added for Tooltips (up to and including 9.4.7)
Rule details
Modules Anywhere - Modules Anywhere (modulesanywhere) below 9.0.0 - Stored XSS, Access Control Bypass and Information Disclosure
Regular Labs Modules Anywhere before 9.0.0 is affected by issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): tag-provided module content and title overrides able to render unsafe markup (stored XSS); content tags able to bypass module access or publication through unapproved ignore flags or property overrides (access-control bypass); the editor popup exposing module data to unauthorized logged-in users without request token checks (information disclosure); and Smart Search indexing modules visible only to administrators. Several fixes are BC breaks (tag-provided content now renders as escaped text). Update to Modules Anywhere 9.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64793, CVE-2026-64795, CVE-2026-65757.
Affected versions: ≤ 8.4.1
Full advisory: regularlabs.com
Users Anywhere - Users Anywhere (usersanywhere) below 2.0.0 - SSRF, Stored XSS and Sensitive Data Exposure
Regular Labs Users Anywhere before 2.0.0 is affected by issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): external image downloads accepting unsafe hosts, redirects, non-image responses or local download folders (SSRF); tag-provided field custom HTML overrides able to render unsafe markup (stored XSS); and tags able to expose authentication data or restricted contact details. Several fixes are BC breaks (field custom HTML now renders as escaped text). Update to Users Anywhere 2.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64794, CVE-2026-64795, CVE-2026-64799, CVE-2026-65755.
Affected versions: ≤ 1.2.7
Full advisory: regularlabs.com
Modals - Modals (modals) below 16.0.0 - Stored XSS and Path Traversal
Regular Labs Modals before 16.0.0 is affected by issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): decoded modal data title, description and HTML values able to execute unsafe markup (stored XSS - decoded modal HTML now strips scripts, event handlers and executable URLs); and (Pro) gallery folders accepting unsafe relative paths (path traversal). Update to Modals 16.0.0 or later (16.0.1 is a same-day bugfix follow-up). CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64795, CVE-2026-65713.
Affected versions: ≤ 15.0.0
Full advisory: regularlabs.com
Tooltips - Tooltips (tooltips) below 10.0.0 - Stored XSS
Regular Labs Tooltips before 10.0.0 is affected by an issue fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): decoded tooltip data title and content values able to execute unsafe markup (stored XSS - decoded tooltip HTML now strips scripts, event handlers and executable URLs), plus privileged AJAX endpoints not consistently enforcing valid tokens and permissions. Update to Tooltips 10.0.0 or later (10.0.1 is a same-day bugfix follow-up). CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64795.
Affected versions: ≤ 9.4.7
Full advisory: regularlabs.com
Other vulnerabilities in Articles Anywhere, Modals, Modules Anywhere, Users Anywhere and Tooltips
Updating for CVE-2026-64795 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extensions.
Articles Anywhere
Latest safe version: 20.1.1
- CVE-2026-64793 Critical, up to and including 18.0.2
- CVE-2026-64794 Critical, up to and including 18.0.2
- CVE-2026-64799 Critical, up to and including 18.0.2
- CVE-2026-65755 Critical, up to and including 18.0.2
- CVE-2026-63265 Critical, up to and including 18.0.2
- CVE-2026-64792 Critical, up to and including 18.0.2
- CVE-2026-102802 High, from 19.0.0 up to but not including 20.1.1
- CVE-2026-85195 High, from 8.4.0 up to but not including 20.0.0
Modals
Latest safe version: 17.0.0
- CVE-2026-85189 High, from 4.0.0 up to but not including 17.0.0
- CVE-2026-88853 High, from 4.0.0 up to but not including 17.0.0
- CVE-2026-65713 Medium, up to and including 15.0.0
- CVE-2026-63265 Medium, up to and including 15.0.0
Modules Anywhere
Latest safe version: 10.0.0
- CVE-2026-65757 Critical, up to and including 8.4.1
- CVE-2026-64793 Critical, up to and including 8.4.1
- CVE-2026-63265 Critical, up to and including 8.4.1
- CVE-2026-64792 Critical, up to and including 8.4.1
- CVE-2026-100750 High, from 1.5.0 up to but not including 10.0.0
Users Anywhere
Latest safe version: 3.0.1
- CVE-2026-64794 High, up to and including 1.2.7
- CVE-2026-64799 High, up to and including 1.2.7
- CVE-2026-65755 High, up to and including 1.2.7
- CVE-2026-63265 High, up to and including 1.2.7
- CVE-2026-102801 Medium, before 3.0.1
- CVE-2026-85196 Medium, from 1.0.0 up to but not including 2.1.0
References
- CVE-2026-64795 on cve.org (the official CVE record)
- CVE-2026-64795 in the NIST National Vulnerability Database
- regularlabs.com/latest-releases
CVE-2026-64795 questions
Which versions are affected by CVE-2026-64795?
CVE-2026-64795 is covered by 5 rules: Articles Anywhere up to and including 18.0.2; Modules Anywhere up to and including 8.4.1; Users Anywhere up to and including 1.2.7; Modals up to and including 15.0.0; Tooltips up to and including 9.4.7.
How do I fix CVE-2026-64795?
It depends on the extension and release line your site runs. For Articles Anywhere up to and including 18.0.2: update Articles Anywhere to 19.0.0 for this flaw, or to 20.1.1 or later, which no rule we check matches. For Modules Anywhere up to and including 8.4.1: update Modules Anywhere to 9.0.0 for this flaw, or to 10.0.0 or later, which no rule we check matches. For Users Anywhere up to and including 1.2.7: update Users Anywhere to 2.0.0 for this flaw, or to 3.0.1 or later, which no rule we check matches. For Modals up to and including 15.0.0: update Modals to 16.0.0 for this flaw, or to 17.0.0 or later, which no rule we check matches. For Tooltips up to and including 9.4.7: update Tooltips to 10.0.0 or later.
How severe is CVE-2026-64795?
CISA-ADP scores it 5.4 (Medium) under CVSS 3.1. In plain terms: reachable across the internet, any logged-in account will do and someone has to click or visit something.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 12 November 2026.