The Articles Anywhere and Users Anywhere extensions for Joomla prior to versions 20.0.0 and 2.1.0 respectively, including their Pro versions, suffer from a reflected XSS vulnerability (CWE-79). This occurs because the extensions return request-input data tags without adequate context-sensitive sanitization, allowing attacker-controlled input to be executed as code in various HTML contexts. Joomla's string input filter does not sufficiently neutralize these inputs for HTML text, attributes, or URLs, enabling potential injection of executable URLs or event attributes. The vulnerability is confirmed in versions =8.4.0-19.0.6 for Articles Anywhere and =1.0.0-2.0.6 for Users Anywhere. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction needed, and low confidentiality and integrity impact.

An attacker can exploit this vulnerability by crafting a specially crafted request that injects malicious scripts into web pages generated by the affected Joomla extensions. This can lead to execution of arbitrary scripts in the context of the victim's browser, potentially enabling session hijacking, defacement, or redirection to malicious sites. However, the impact is rated medium due to the requirement of user interaction and the limited confidentiality and integrity impact.

No official patch or vendor advisory with remediation instructions is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling or restricting use of the affected extensions or applying web application firewall (WAF) rules to detect and block reflected XSS attempts targeting these components.