The Articles Anywhere extension for Joomla versions 14.0.0 through 19.0.6 improperly neutralizes input during web page generation, specifically in the handling of link options like onclick and onmouseover. These options become real HTML event attributes without checking the trust level of the article author, enabling privileged stored cross-site scripting (CWE-79). The plugin syntax bypasses Joomla's standard Author content filter because the executable HTML is generated after filtering, allowing malicious scripts to be stored and executed in the context of users with elevated privileges.

Successful exploitation allows an attacker with article author privileges to inject malicious scripts that execute in the context of other users viewing the affected Joomla site. This can lead to privilege escalation, data theft, or other unauthorized actions depending on the victim's permissions. The vulnerability requires attacker privileges to create or modify articles but does not require user interaction for exploitation. The CVSS 4.0 score is 7.5 (high severity), reflecting network attack vector, low attack complexity, partial privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

No official patch or fix is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict article author privileges to trusted users only and consider disabling or limiting the use of link options such as onclick and onmouseover in Articles Anywhere. Monitor for updates from regularlabs.com and Joomla regarding patches or official mitigations.