Skip to main content
mySites.guru
Free Audit
New features added last monthRelease RadarFile ManagerImpostor FilesUpdate QueueRogue AdminsMCP & APIJoomla VELCVE Index

Advanced Module Manager security vulnerabilities

mySites.guru tracks 2 vulnerabilities in Advanced Module Manager (advancedmodules), covering 5 CVEs. Every connected Joomla site is checked against them on each audit.

Is my site affected?

Your site is affected if it runs Advanced Module Manager in any of these ranges:

  • from 12.0.0 up to but not including 12.1.0
  • up to and including 11.0.1
Latest safe version
12.1.0 or later. No rule we check matches that release or any newer one.
What to do
Update Advanced Module Manager to 12.1.0 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Check whether your sites are affected

Every Advanced Module Manager vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
CVE-2026-85188CVSS 6.9from 12.0.0 up to but not including 12.1.012.1.0Medium2026-09-13
CVE-2026-63280CVSS 8.8CVE-2026-63281CVSS 4.8CVE-2026-63683CVSS 7.5CVE-2026-63265CVSS 8.0up to and including 11.0.1after 11.0.1Medium2026-07-22

What we check for

MediumCVE-2026-851882026-09-13

Advanced Module Manager (advancedmodules) 12.0.0 to below 12.1.0 - Authenticated Information Disclosure via Condition Set Labels

Regular Labs Advanced Module Manager 12.0.0 through 12.0.4 is affected by CVE-2026-85188, fixed in 12.1.0 (released 13 September 2026). CVE-2026-85188 is a shared-code defect: the same Condition Set implementation ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. The same release also adds settings restricting who may save PHP Condition Rules. Update to 12.1.0 or later. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.

Affected versions: ≥ 12.0.0 and < 12.1.0

Full advisory: regularlabs.com

MediumCVE-2026-63280CVE-2026-63281CVE-2026-63683CVE-2026-632652026-07-22

Regular Labs Advanced Module Manager (com_advancedmodules) <= 11.0.1 - Broken Access Control, Stored XSS and GeoIP Rule Bypass

Regular Labs Advanced Module Manager up to and including 11.0.1, via the bundled Conditions component and the shared Regular Labs library. Conditions administration did not consistently enforce tokens and component/mapped-item permissions (CVE-2026-63280); stored condition values could execute HTML/JavaScript in administrator summaries (CVE-2026-63281); IP and GeoIP conditions trusted spoofable forwarded headers, letting a remote client bypass location-based display rules (CVE-2026-63683); and privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens or matching permissions (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (12.0.0).

Affected versions: ≤ 11.0.1

Full advisory: our disclosure post

Timeline

  1. 22 July 2026Check added for CVE-2026-63280, CVE-2026-63281, CVE-2026-63683 and CVE-2026-63265 (up to and including 11.0.1)
  2. 22 July 2026CVE-2026-63280 record published
  3. 22 July 2026CVE-2026-63281 record published
  4. 22 July 2026CVE-2026-63683 record published
  5. 22 July 2026CVE-2026-63265 record published
  6. 13 September 2026Check added for CVE-2026-85188 (from 12.0.0 up to but not including 12.1.0)
  7. 14 September 2026CVE-2026-85188 record published

References

Each CVE page above links its official cve.org record and its NVD entry.

Advanced Module Manager vulnerability questions

Which versions of Advanced Module Manager are vulnerable?
mySites.guru tracks 2 vulnerabilities in Advanced Module Manager (advancedmodules). A site is affected if its installed version is in any of these ranges: from 12.0.0 up to but not including 12.1.0; up to and including 11.0.1.
What is the latest safe version of Advanced Module Manager?
12.1.0. Every vulnerability tracked here is fixed by 12.1.0, and no rule we check matches that release or any later one.
How do I check which version of Advanced Module Manager my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for advancedmodules. mySites.guru reads the installed version on every audit of a connected site and checks it against these rules.

Running Advanced Module Manager on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

CVE identifiers: CVE-2026-85188, CVE-2026-63280, CVE-2026-63281, CVE-2026-63683, CVE-2026-63265. Rules current as of 13 October 2026.