Regularlabs.com vulnerabilities
We track 28 vulnerabilities in Regularlabs.com products across 40 products. 28 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2026.
Latest Regularlabs.com vulnerabilities
- 8.9 High severity
Sourcerer Free extension for Joomla: Improper Control of Generation of Code
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rul
- 7.5 High severity
Modules Anywhere (Pro) extension for Joomla: Server-Side Request Forgery
Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. This feature is enabled by default in affected v
- 7.5 High severity
Modals (Pro) extension for Joomla: Improper Neutralization of Input During Web Page Generation
Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0 - Modals Pro intentionally supports JavaScript Events such as on-open and on-closed. Affected versions do not distinguish trusted ex
- 7.5 High severity
Snippets (Free) extension for Joomla: Improper Neutralization of Input During Web Page Generation
Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.0 - Snippets substitutes variable values supplied by an article tag into saved Snippet content. Th
- 7.5 High severity
Articles Anywhere (Free, Pro) extension for…: Improper Neutralization of Input During Web Page Generation
Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0 - Articles Anywhere accepts link options such as onclick and onmouseover. In affected versions, those options become real HTML event a
- 9.4 Critical severity
Conditional Content Pro extension for Joomla: Improper Control of Generation of Code
Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0 - Conditional Content Pro accepts inline PHP Condition Rules in article syntax. In affected versions, the PHP is passed to
- 7.5 High severity
Tabs & Accordions (Free, Pro) extension for…: Improper Neutralization of Input During Web Page Generation
Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0 - Tabs & Accordions rewrites links matching an item alias into calls to its browser API. The affected renderer places the alias i
- 7.5 High severity
Quick Index (Free, Pro) extension for Joomla: Improper Neutralization of Input During Web Page Generation
Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5 - Quick Index inserts configurable class values into generated HTML without escaping them for an HTML attribute. A crafted value can close t
- 7.5 High severity
Modals (Free, Pro) extension for Joomla: Improper Neutralization of Input During Web Page Generation
Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0 - Modals treats a destination using an executable browser URL scheme as an ordinary modal URL. The value can reach both the generated
- 10.0 Critical severity
Sourcerer extension for Joomla: Improper Control of Generation of Code
Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0 - Regular Labs Sourcerer before 16.0.0 processes {source} blocks found in Joomla’s final rendered HTML without reliably determining where tha
- 8.1 High severity
Modules Anywhere extension for Joomla: Improper Access Control
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.
- 7.5 High severity
Articles Anywhere extension for Joomla: Use of Cache Containing Sensitive Information
Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or
- 7.5 High severity
ReReplacer PRo extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory.
- 9.8 Critical severity
GeoIP extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions.
- 7.5 High severity
GeoIP extension for Joomla: Exposure of Sensitive Information to an Unauthorized Actor
Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability.
- 8.8 High severity
GeoIP extension for Joomla: Improper Access Control
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates.
- 7.5 High severity
Articles Anywhere Pro extension for Joomla: Server-Side Request Forgery
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without valid
- 9.1 Critical severity
IP Login extension for Joomla: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.
- 7.5 High severity
IP Login extension for Joomla: Authentication Bypass by Spoofing
Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate
- 9.8 Critical severity
Sourcerer extension for Joomla: Improper Access Control
Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaSc
- 9.1 Critical severity
Articles Anywhere extension for Joomla: Improper Access Control
Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content autho
- 7.5 High severity
Articles Anywhere extension for Joomla: Use of Cache Containing Sensitive Information
Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted o
- 8.8 High severity
Regular Labs Extension Manager extension for…: Improper Access Control
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissio
- 8.8 High severity
DB Replacer extension for Joomla: Improper Access Control
Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform d
- 8.8 High severity
Content Templater extension for Joomla: Improper Access Control
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-per
- 7.5 High severity
Advanced Module Manager extension for Joomla: Authentication Bypass by Spoofing
Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules.
- 8.8 High severity
Advanced Module Manager extension for Joomla: Improper Access Control
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions administration did not consistently enforce tokens and component/mapped-item permissions.
- 8.0 High severity
Advanced Module Manager extension for Joomla: Improper Access Control
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions