Extensions
29 articles tagged Extensions, newest first.
Phoca Gallery 6.1.6 fixes a stored XSS hidden in a photo's EXIF data
Phoca Gallery 4.5.0 to 6.1.5 lets a crafted image's EXIF data run script on the photo info view. 6.1.6 fixes it on Joomla 6 only; Joomla 4 and 5 are stranded.
The Joomla Content Editor (JCE) Hack, Four Months On
Four months after the JCE hack hit Joomla sites, unpatched installs are still being compromised. See the damage and how mySites.guru finds and fixes it.
Fixing Class "JPlugin" not found in Joomla 5 and 6
Class "JPlugin" not found (or JFactory, JComponentHelper) means a Joomla extension lost the Backward Compatibility plugin. How to find and fix it.
Event Gallery 6.6.0 Fixes Forged Backend Changes and a Google Photos Token Leak
Event Gallery 6.6.0 fixes a backend CSRF, a Google Photos token leak and an XSS (CVE-2026-102776 to 102778). Every Joomla site below 6.6.0 needs it.
Joomla 6.2 Is Out: Requirements, Changes and Which Sites Can Take It
Joomla 6.2.0 shipped on 13 October 2026 with the 6.1 requirements, no documented breaking changes and no security fixes. What is new and which sites can update.
Phoca Cart 6.1.9 stops anyone downloading other customers' paid files
Phoca Cart before 6.1.9 let anonymous visitors download the digital products other customers bought. Only the Joomla 6 line is fixed, and 6.1.8 is affected.
Quix Page Builder 6.3.4 Fixes Guest Access and Editor Code Execution Flaws
Quix Page Builder 6.3.4 stops guests changing Quix settings or reading restricted pages, and editors running code on the server. Update every Joomla site.
JCTables for Joomla: Unauthenticated SQL Injection Fixed in 1.21.1
CVE-2026-76570 lets anyone read and rewrite a Joomla database through the JCTables extension without logging in. Scored 10.0 Critical, fixed in 1.21.1.
Event Gallery 6.5.0 Hides Eight Security Fixes in 46 Bug Fixes
Event Gallery 6.5.0 fixes five CVEs in Joomla, led by a Clear Cache path traversal (CVE-2026-97164). The vendor's notes now lead with security.
YouTube Gallery for Joomla: Unauthenticated SQL Injection Fixed in 5.7.3
CVE-2026-94130: an unauthenticated SQL injection in JoomlaBoat's YouTube Gallery for Joomla, scored 9.3 Critical. Every version below 5.7.3 is affected.
AcyMailing 11.1.0 Fixes Two Security Flaws
AcyMailing 11.1.0 fixes a mailbox file write and a file deletion flaw, now CVE-2026-94132 (9.5 Critical) and CVE-2026-94131, both filed under Bug fixes.
T4 Page Builder 2.3.0 Fixes an Unauthenticated Mail Relay
JoomlArt's T4 Page Builder 2.3.0 closes an unauthenticated open mail relay we reported in August. A week on, five in six installs we see are still older.
Release Radar, a Free Joomla and WordPress Release Tracker
A free public log of new Joomla and WordPress extension releases, including the paid ones no plugin directory covers. RSS and JSON, no account needed.
Phoca Cart 5.2.4, 6.1.7 and 4.0.13 fix a front-end SQL injection
Phoca Cart 5.2.4, 6.1.7 and 4.0.13 patch an unauthenticated SQL injection in the Joomla extension's product filter. Joomla 5 on 6.x isn't offered it.
Twenty Rules for Joomla Extension Developers Handling a Security Report
A new Joomla Manual page sets out 20 rules for how extension developers should handle a security report. Republished here in full under the JEDL.
JCE 2.9.99.10 Fixes Another Security Issue
JCE 2.9.99.10 patches a file rename flaw letting a privileged user create a hidden file in the folder they were browsing. The release hardens more too.
Joomla Update Error 999: a Dead Extension Redirecting to LinkedIn
The Joomla 'Invalid status code 999' update error is an abandoned extension whose update site redirects to LinkedIn. Here is the fix.
A New mySites.guru Tool to Find, and Fix, the JCE Profiles Hack (June 2026)
The JCE profiles hack exploits CVE-2026-48907, fixed in JCE 2.9.99.5. mySites.guru finds rogue profiles and webshells on every Joomla site. Patch to 2.9.99.11.
JCE Pro 2.9.99.6 Is a Hardening Release After a Full Audit of Joomla's Most-Installed Editor
JCE Pro 2.9.99.6 follows a four-day security audit of the editor, narrowing entry points and hardening input validation. Recommended for every JCE site.
JCE Free/Pro 2.9.99.5 Patches an Unauthenticated File Upload in Joomla's Most-Installed Editor
JCE Free and JCE Pro 2.9.99.5 patch an unauthenticated editor profile upload that could upload arbitrary files. Update every Joomla site running JCE.
JCE Free/Pro 2.9.99.4 Patches Two Authenticated Vulnerabilities in Joomla's Most Popular Editor
JCE Free and JCE Pro 2.9.99.4 patch an Editor Profile authentication bypass and a directory traversal in filesystem search. Update JCE today.
How to Enable Joomla Extension Auto-Updates Safely
How to enable auto-updates for Joomla extensions across one site or hundreds, with backup and rollback steps that keep client sites safe if an update breaks.
Joomla's Compat Plugin Is a Crutch, Not a Fix
Joomla's backward compatibility plugins keep broken extensions alive. Why that's technical debt, how to test without them, and how to recover.
Automatic Updates for Any Joomla Extension
Enable automatic updates for any Joomla extension that uses a Joomla update site - set per-site or across all connected sites with two clicks.
Install Extensions to Multiple Joomla Sites
Push a Joomla extension install to hundreds of sites simultaneously from the mySites.guru dashboard, with full success and failure notifications per site.
Auto-Upgrade 1000s of Plugins & Extensions
Update Joomla extensions, WordPress plugins, and CMS cores across all your sites from one mySites.guru dashboard. Select all, click upgrade, done.
Install Extensions to 1000+ Sites at Once
Install any Joomla extension or WordPress plugin across 1,000 sites in one go using the mySites.guru bulk install tool - no SSH or FTP needed.
Manage all your Joomla Sites Extensions with mySites.guru
View, search and update every Joomla extension across all your connected sites from a single page in mySites.guru.
Top 50 Joomla Extensions in 2026
Real-time ranking of the top 50 most-installed Joomla extensions, pulled live from the mySites.guru database of 90,000+ connected sites.