Quick Index security vulnerabilities

mySites.guru tracks 2 vulnerabilities in quickindex. Every connected Joomla site is checked against them on each audit, and flagged if it runs an affected version.

Check whether your sites are affected

What we check for

HighCVE-2026-851902026-09-13

Quick Index (quickindex) 5.0.0 to below 5.0.5 - Authenticated Stored XSS via Crafted Index Class Options

Regular Labs Quick Index 5.0.0 through 5.0.4 is affected by CVE-2026-85190, fixed in 5.0.5 (released 13 September 2026). Crafted index class options were not sanitised, allowing JavaScript to be injected into the rendered index. Exploitation requires the ability to author or edit content containing a Quick Index tag, so this is an authenticated stored XSS. Update to 5.0.5 or later. The same release also fixes indexes showing headings from articles the visitor cannot access, an access control defect the vendor did not label a security fix but which discloses restricted article titles to unauthorised visitors. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 7.5 (High), vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/S:N/AU:N.

Affected versions: ≥ 5.0.0 and < 5.0.5

Full advisory: regularlabs.com

MediumCVE-2026-632652026-07-22

Regular Labs Quick Index (quickindex) <= 4.3.6 - Broken Access Control (Regular Labs AJAX endpoints)

Regular Labs Quick Index up to and including 4.3.6. Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration, so authenticated lower-privileged users, or a CSRF attack, could invoke lookups or mutations outside their authorisation (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (5.0.0).

Affected versions: ≤ 4.3.6

Full advisory: our disclosure post

Running Quick Index on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

CVE identifiers: CVE-2026-85190, CVE-2026-63265. Rules current as of 3 October 2026.