Skip to main content
mySites.guru
Free Audit
CriticalA PHP security release fixes two CVSS 9.2 flaws, and PHP 8.1 and older get no patchWhat it means for your site

Content Templater security vulnerabilities

mySites.guru tracks 2 vulnerabilities in Content Templater (com_contenttemplater), covering 5 CVEs. Every connected Joomla site is checked against them on each audit.

Is my site affected?

Your site is affected if it runs Content Templater in any of these ranges:

  • from 14.0.0 up to but not including 14.2.0
  • up to and including 13.0.0
Latest safe version
14.2.0 or later. No rule we check matches that release or any newer one.
What to do
Update Content Templater to 14.2.0 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Check whether your sites are affected

Every Content Templater vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
CVE-2026-85188CVSS 6.9from 14.0.0 up to but not including 14.2.014.2.0Medium2026-09-13
CVE-2026-63684CVSS 8.8CVE-2026-63280CVSS 8.8CVE-2026-63281CVSS 4.8CVE-2026-63683CVSS 7.5up to and including 13.0.0after 13.0.0Medium2026-07-22

What we check for

MediumCVE-2026-851882026-09-13

Content Templater (contenttemplater) 14.0.0 to below 14.2.0 - Authenticated Information Disclosure via Condition Set Labels

Regular Labs Content Templater 14.0.0 through 14.1.0 is affected by CVE-2026-85188, fixed in 14.2.0 (released 13 September 2026). Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. The same Condition Set code ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 14.2.0 or later. The same release also adds settings restricting who may save PHP Condition Rules, and fixes Condition Set saves not respecting publication and linked-item edit permissions. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.

Affected versions: ≥ 14.0.0 and < 14.2.0

Full advisory: regularlabs.com

MediumCVE-2026-63684CVE-2026-63280CVE-2026-63281CVE-2026-636832026-07-22

Regular Labs Content Templater (com_contenttemplater) <= 13.0.0 - Broken Access Control and Stored XSS

Regular Labs Content Templater up to and including 13.0.0. Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks (CVE-2026-63684). Via the bundled Conditions component it is also affected by CVE-2026-63280 (missing tokens/permissions in Conditions administration), CVE-2026-63281 (stored XSS in administrator summaries) and CVE-2026-63683 (spoofable IP/GeoIP condition headers), plus CVE-2026-63265 (Regular Labs AJAX endpoints). Fixed in the Regular Labs security release of 22 July 2026 (14.0.0).

Affected versions: ≤ 13.0.0

Full advisory: our disclosure post

Timeline

  1. 22 July 2026Check added for CVE-2026-63684, CVE-2026-63280, CVE-2026-63281 and CVE-2026-63683 (up to and including 13.0.0)
  2. 22 July 2026CVE-2026-63684 record published
  3. 22 July 2026CVE-2026-63280 record published
  4. 22 July 2026CVE-2026-63281 record published
  5. 22 July 2026CVE-2026-63683 record published
  6. 13 September 2026Check added for CVE-2026-85188 (from 14.0.0 up to but not including 14.2.0)
  7. 14 September 2026CVE-2026-85188 record published

References

Each CVE page above links its official cve.org record and its NVD entry.

Content Templater vulnerability questions

Which versions of Content Templater are vulnerable?
mySites.guru tracks 2 vulnerabilities in Content Templater (com_contenttemplater). A site is affected if its installed version is in any of these ranges: from 14.0.0 up to but not including 14.2.0; up to and including 13.0.0.
What is the latest safe version of Content Templater?
14.2.0. Every vulnerability tracked here is fixed by 14.2.0, and no rule we check matches that release or any later one.
How do I check which version of Content Templater my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com_contenttemplater. mySites.guru reads the installed version on every audit of a connected site and checks it against these rules.

Running Content Templater on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

CVE identifiers: CVE-2026-85188, CVE-2026-63684, CVE-2026-63280, CVE-2026-63281, CVE-2026-63683. Rules current as of 23 October 2026.