CVE-2026-74253: Regularlabs.com Sourcerer Extension For Joomla

Critical severity, CVSS 10.0. EPSS: 0.4% chance of exploitation in the next 30 days.

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0 - Regular Labs Sourcerer before 16.0.0 processes {source} blocks found in Joomla’s final rendered HTML without reliably determining where that code originated.

Affected products

Published 2026-08-17. Last modified 2026-08-26.