Stored XSS Vulnerability in Snippets Extension for Joomla by Regular Labs
CVE-2026-88852

7.5HIGH

Key Information:

Vendor

Regularlabs.com

Status
Snippets (free) Extension For Joomla
Snippets (pro) Extension For Joomla
Vendor
CVE Published:
14 September 2026

What is CVE-2026-88852?

A stored cross-site scripting vulnerability exists in the Snippets Free and Pro extensions for Joomla. The bug arises when lower-privileged authors can inject unsafe values into security-sensitive areas of snippet content due to improper trust level validation. This can lead to execution of malicious scripts whenever the affected Snippets are displayed, potentially compromising the integrity of the site and its users.

Affected Version(s)

Snippets (Free) extension for Joomla 1.0.0-6.9.4

Snippets (Pro) extension for Joomla 1.0.0-10.0.6

References

https://www.regularlabs.com/
product

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.