CVE-2026-85196MediumCVSS 5.3CVE published 14 September 2026Added to mySites.guru 13 September 2026

Articles Anywhere (articlesanywhere) 19.0.0 to below 20.0.0 - Authenticated Stored and Reflected XSS via Unescaped Request Input and JavaScript Events

Q: Which versions are affected by CVE-2026-85196?

CVE-2026-85196 is covered by 2 rules: Articles Anywhere from 19.0.0 up to but not including 20.0.0; Users Anywhere from 2.0.0 up to but not including 2.1.0.

Q: How do I fix CVE-2026-85196?

It depends on the extension and release line your site runs. For Articles Anywhere from 19.0.0 up to but not including 20.0.0: update Articles Anywhere to 20.0.0 or later. For Users Anywhere from 2.0.0 up to but not including 2.1.0: update Users Anywhere to 2.1.0 or later.

Q: How severe is CVE-2026-85196?

Joomla CNA scores it 5.3 (Medium) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and someone has to visit a page.

Regular Labs Articles Anywhere 19.0.0 through 19.0.6 is affected by two vendor-confirmed security defects, both fixed in 20.0.0 (released 13 September 2026). CVE-2026-85196: request input consumed by Articles Anywhere data tags was not escaped, and the optional raw output mode was available to any article author, allowing script to be injected into rendered article content. CVE-2026-85195: JavaScript Events could be attached by any user able to author article content; 20.0.0 restricts them to selected article author groups by default. Exploitation requires the ability to author or edit content containing Articles Anywhere tags, or a page that already feeds request input into one, so this is an authenticated stored XSS with a reflected vector on affected pages. Update to 20.0.0 or later. Note that 20.0.0 is flagged by the vendor as a BC BREAK: the JavaScript Events restriction is enabled by default and has to be re-opened deliberately per author group, so review those settings after updating. The same release also tightens destination checks for external image downloads, which the vendor did not label a security fix. The CVE records were published on 14 September 2026: CVE-2026-85195 at CVSS 4.0 7.5 (High), vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/S:N/AU:N; CVE-2026-85196 at CVSS 4.0 5.3 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N.

Is my site affected?

CVE-2026-85196 is checked by 2 rules. Find the extension and release line your site runs:

Extension	Affected versions	Fixed in	What to do
Articles Anywhere	from 19.0.0 up to but not including 20.0.0	20.0.0	Update Articles Anywhere to 20.0.0 or later.
Users Anywhere	from 2.0.0 up to but not including 2.1.0	2.1.0	Update Users Anywhere to 2.1.0 or later.

Check whether your sites are affected

How CVE-2026-85196 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

5.3 Medium

CVSS 4.0, scored by Joomla CNA

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

How it is reached

AV:N Attack vector: Network. Reachable across the internet
AC:L Attack complexity: Low. Nothing to work around, it just works
AT:N Attack requirements: None. Works against any affected install
PR:N Privileges required: None. No account needed
UI:P User interaction: Passive. Someone has to visit a page

What it does to the site

VC:L Confidentiality: Low. Some data can be read
VI:L Integrity: Low. Some data can be altered
VA:N Availability: None. The site stays up

What it does beyond the site

SC:N Confidentiality: None. Other systems keep their data
SI:N Integrity: None. Other systems keep their integrity
SA:N Availability: None. Other systems stay up

The rule below is rated High for the set of 2 CVEs it covers together, not for this record on its own.

Timeline

13 September 2026mySites.guru check added for Articles Anywhere (from 19.0.0 up to but not including 20.0.0)
13 September 2026mySites.guru check added for Users Anywhere (from 2.0.0 up to but not including 2.1.0)
14 September 2026CVE-2026-85196 record published by its CNA

Rule details

HighCVE-2026-85195 CVE-2026-851962026-09-13

Articles Anywhere

Affected versions: ≥ 19.0.0 and < 20.0.0

Full advisory: regularlabs.com

MediumCVE-2026-851962026-09-13

Users Anywhere - Users Anywhere (usersanywhere) 2.0.0 to below 2.1.0 - Authenticated Stored and Reflected XSS via Unescaped Request Input

Regular Labs Users Anywhere 2.0.0 through 2.0.6 is affected by CVE-2026-85196, fixed in 2.1.0 (released 13 September 2026). Request input consumed by Users Anywhere data tags was not escaped, and the optional raw output mode was available to any article author, allowing script to be injected into rendered content. This is the same defect and the same CVE the vendor fixed in Articles Anywhere 20.0.0, the two extensions sharing the data-tag code. Exploitation requires the ability to author or edit content containing Users Anywhere tags, or a page that already feeds request input into one. Update to 2.1.0 or later. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 5.3 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N.

Affected versions: ≥ 2.0.0 and < 2.1.0

Full advisory: regularlabs.com

References

CVE-2026-85196 questions

Which versions are affected by CVE-2026-85196?

CVE-2026-85196 is covered by 2 rules: Articles Anywhere from 19.0.0 up to but not including 20.0.0; Users Anywhere from 2.0.0 up to but not including 2.1.0.

How do I fix CVE-2026-85196?

It depends on the extension and release line your site runs. For Articles Anywhere from 19.0.0 up to but not including 20.0.0: update Articles Anywhere to 20.0.0 or later. For Users Anywhere from 2.0.0 up to but not including 2.1.0: update Users Anywhere to 2.1.0 or later.

How severe is CVE-2026-85196?

Joomla CNA scores it 5.3 (Medium) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and someone has to visit a page.

Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

Rules current as of 13 October 2026.