CVE-2026-63281

Deferred Deferred - Pending Action

Stored XSS in Joomla Administrator Summaries

Publication date: 2026-07-22

Last updated on: 2026-07-27

Assigner: Joomla! Project

Description

Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/JavaScript in administrator summaries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-27

Generated

2026-08-12

AI Q&A

2026-07-23

EPSS Evaluated

2026-08-10

NVD

CVE-2026-63281

Affected Vendors & Products

Vendor	Product	Version / Range
regularlabs	conditions_manager	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability allows stored condition values to execute HTML or JavaScript code in administrator summaries. This could lead to unauthorized code execution when administrators view affected summaries.

Impact Analysis

An attacker could inject malicious scripts into administrator views, potentially stealing session cookies, performing actions on behalf of administrators, or defacing the site. This compromises the integrity and confidentiality of the system.

Compliance Impact

This vulnerability could allow stored cross-site scripting (XSS) in administrator summaries, potentially enabling unauthorized execution of HTML or JavaScript. This may lead to data breaches or unauthorized access, which could violate GDPR (data protection) or HIPAA (healthcare data privacy) compliance if sensitive data is exposed or manipulated.

Mitigation Strategies

Update the Regular Labs Conditions Manager extension to the latest patched version immediately. Disable the extension if an update is not available. Review administrator summaries for suspicious HTML or JavaScript code.

Hi! I’m here to help you understand CVE-2026-63281. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70