The Articles Anywhere extension for Joomla contains a stored XSS vulnerability that could allow an authenticated administrator to execute arbitrary JavaScript within the application context.

The vulnerability is a stored cross-site scripting (CWE-79) flaw. It occurs because the extension fails to sanitize link attributes like onclick and onmouseover, allowing them to bypass Joomla content filters and execute as HTML event attributes.

Successful exploitation allows an attacker with high privileges to execute malicious scripts in the context of other users or administrators viewing the affected content. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk of session hijacking, unauthorized administrative actions, or unauthorized data access, potentially leading to a full site compromise.

Immediate Action: Update the Articles Anywhere extension to version 20.0.0 or later as soon as it becomes available from the vendor.

Proactive Monitoring: Review administrative audit logs for unusual link modifications or suspicious script injections within article content.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized inline scripts and event handlers.

Public Exploit Available: No — there is no confirmed public exploit or proof-of-concept available at this time.

This vulnerability represents a significant security risk for Joomla sites utilizing the Articles Anywhere extension. Administrators should prioritize updating the extension immediately upon the release of a patched version. Until an update is applied, exercise caution regarding administrative account security and limit content creation permissions to trusted users.