Skip to main content
mySites.guru
New features added last monthRelease RadarFile ManagerImpostor FilesUpdate QueueRogue AdminsMCP & APIJoomla VELCVE Index

Content Templater security vulnerabilities

mySites.guru tracks 5 vulnerabilities in com_contenttemplater. Every connected Joomla site is checked against them on each audit, and flagged if it runs an affected version.

What we check for

MediumCVE-2026-851882026-09-13

Content Templater (contenttemplater) 14.0.0 to below 14.2.0 - Authenticated Information Disclosure via Condition Set Labels

Regular Labs Content Templater 14.0.0 through 14.1.0 is affected by CVE-2026-85188, fixed in 14.2.0 (released 13 September 2026). Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. The same Condition Set code ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 14.2.0 or later. The same release also adds settings restricting who may save PHP Condition Rules, and fixes Condition Set saves not respecting publication and linked-item edit permissions. As at 13 September 2026 the CVE record(s) for this advisory are RESERVED and not yet published, so no official CVSS score exists yet and the severity recorded here is mySites.guru's own assessment, to be revised when the records go live.

Affected versions: ≥ 14.0.0 and < 14.2.0

Full advisory: regularlabs.com

MediumCVE-2026-851882026-09-13

Content Templater (contenttemplater) 14.0.0 to below 14.2.0 - Authenticated Information Disclosure via Condition Set Labels

Regular Labs Content Templater 14.0.0 through 14.1.0 is affected by CVE-2026-85188, fixed in 14.2.0 (released 13 September 2026). Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. The same Condition Set code ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 14.2.0 or later. The same release also adds settings restricting who may save PHP Condition Rules, and fixes Condition Set saves not respecting publication and linked-item edit permissions. As at 13 September 2026 the CVE record(s) for this advisory are RESERVED and not yet published, so no official CVSS score exists yet and the severity recorded here is mySites.guru's own assessment, to be revised when the records go live.

Affected versions: ≥ 14.0.0 and < 14.2.0

Full advisory: regularlabs.com

MediumCVE-2026-851882026-09-13

Content Templater (contenttemplater) 14.0.0 to below 14.2.0 - Authenticated Information Disclosure via Condition Set Labels

Regular Labs Content Templater 14.0.0 through 14.1.0 is affected by CVE-2026-85188, fixed in 14.2.0 (released 13 September 2026). Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. The same Condition Set code ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 14.2.0 or later. The same release also adds settings restricting who may save PHP Condition Rules, and fixes Condition Set saves not respecting publication and linked-item edit permissions. As at 13 September 2026 the CVE record(s) for this advisory are RESERVED and not yet published, so no official CVSS score exists yet and the severity recorded here is mySites.guru's own assessment, to be revised when the records go live.

Affected versions: ≥ 14.0.0 and < 14.2.0

Full advisory: regularlabs.com

MediumCVE-2026-851882026-09-13

Content Templater (contenttemplater) 14.0.0 to below 14.2.0 - Authenticated Information Disclosure via Condition Set Labels

Regular Labs Content Templater 14.0.0 through 14.1.0 is affected by CVE-2026-85188, fixed in 14.2.0 (released 13 September 2026). Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. The same Condition Set code ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 14.2.0 or later. The same release also adds settings restricting who may save PHP Condition Rules, and fixes Condition Set saves not respecting publication and linked-item edit permissions. As at 13 September 2026 the CVE record(s) for this advisory are RESERVED and not yet published, so no official CVSS score exists yet and the severity recorded here is mySites.guru's own assessment, to be revised when the records go live.

Affected versions: ≥ 14.0.0 and < 14.2.0

Full advisory: regularlabs.com

Regular Labs Content Templater (com_contenttemplater) <= 13.0.0 - Broken Access Control and Stored XSS

Regular Labs Content Templater up to and including 13.0.0. Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks (CVE-2026-63684). Via the bundled Conditions component it is also affected by CVE-2026-63280 (missing tokens/permissions in Conditions administration), CVE-2026-63281 (stored XSS in administrator summaries) and CVE-2026-63683 (spoofable IP/GeoIP condition headers), plus CVE-2026-63265 (Regular Labs AJAX endpoints). Fixed in the Regular Labs security release of 22 July 2026 (14.0.0).

Affected versions: ≤ 13.0.0

Full advisory: our disclosure post

Running Content Templater on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

CVE identifiers: CVE-2026-85188, CVE-2026-63684, CVE-2026-63280, CVE-2026-63281, CVE-2026-63683. Rules current as of 13 September 2026.