Modules Anywhere (modulesanywhere) below 9.0.0 - Stored XSS, Access Control Bypass and Information Disclosure

Regular Labs Modules Anywhere before 9.0.0 is affected by issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): tag-provided module content and title overrides able to render unsafe markup (stored XSS); content tags able to bypass module access or publication through unapproved ignore flags or property overrides (access-control bypass); the editor popup exposing module data to unauthorized logged-in users without request token checks (information disclosure); and Smart Search indexing modules visible only to administrators. Several fixes are BC breaks (tag-provided content now renders as escaped text). Update to Modules Anywhere 9.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64793, CVE-2026-64795, CVE-2026-65757.

Affected versions: ≤ 8.4.1

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions