Extensions
39 articles tagged Extensions, newest first.
Vik Booking 1.18.21 stops guests saving script as a check-in signature
Vik Booking 1.18.21 for Joomla fixes a stored XSS in guest check-in signatures and adds CSRF checks to invoice tasks. Fourth security release in 22 days.
Digital Peak Is the Latest Joomla Extension Vendor to Drop Joomla 4
Digital Peak joins a list of Joomla extension vendors dropping Joomla 4. Who has stopped, who still builds for Joomla 4, and what a Joomla 4 site does next.
Pause Updates on One Site, or Snooze One Joomla Extension or WordPress Plugin
Snooze one Joomla extension or WordPress plugin update, or pause every update on one client site. Enforced on every route: Update all, API, MCP, auto-updates.
iCagenda 4.0.17 Fixes a Stored XSS in Event Custom Fields
iCagenda 4.0.17 and PRO 3.9.17 fix a stored XSS in url-type event custom fields and a CSV formula injection in registration exports. Update every Joomla site.
Quix Page Builder 6.4.0 Stops Guests Reading Access-Restricted Joomla Articles
Quix Page Builder 6.4.0 fixes an AJAX handler that let anyone read Joomla articles restricted to Registered or custom access levels. Update every Joomla site.
DJ-HelpfulArticles 1.3 fixes a stored XSS anyone could plant in the admin overview
DJ-HelpfulArticles 1.3 fixes CVE-2026-102800, a stored XSS in the Joomla rating widget: a visitor-supplied IP was saved unchecked and shown to admins.
Vik Booking 1.18.19 is its third security release in a week, with fixes for Vik Rent Car and Vik Rent Items
Vik Booking 1.18.19, Vik Rent Car 1.15.13 and Vik Rent Items 1.8.6 fix a CSRF gap and stored XSS. Three Vik Booking security releases in a week. What changed.
Phoca Download 6.1.6 adds the token check its file delete was missing
Phoca Download 6.1.6 fixes CVE-2026-102787, a CSRF flaw in front-end publish, unpublish and delete. Joomla 5 installs it by hand, Joomla 3 and 4 have no fix.
StageIt 5.8.0 and 6.4.0 fix CSRF on every action, and a settings file that could run PHP
StageIt 5.8.0 and 6.4.0 add CSRF protection to every staging action and stop an Options save writing PHP into params.php. Our reading, and what to do.
Phoca Gallery 6.1.6 fixes a stored XSS hidden in a photo's EXIF data
Phoca Gallery 4.5.0 to 6.1.5 lets a crafted image's EXIF data run script on the photo info view. 6.1.6 fixes it on Joomla 6 only; Joomla 4 and 5 are stranded.
The Joomla Content Editor (JCE) Hack, Four Months On
Four months after the JCE hack hit Joomla sites, unpatched installs are still being compromised. See the damage and how mySites.guru finds and fixes it.
Fixing Class "JPlugin" not found in Joomla 5 and 6
Class "JPlugin" not found (or JFactory, JComponentHelper) means a Joomla extension lost the Backward Compatibility plugin. How to find and fix it.
Event Gallery 6.6.0 Fixes Forged Backend Changes and a Google Photos Token Leak
Event Gallery 6.6.0 fixes a backend CSRF, a Google Photos token leak and an XSS (CVE-2026-102776 to 102778). Every Joomla site below 6.6.0 needs it.
Joomla 6.2 Is Out: Requirements, Changes and Which Sites Can Take It
Joomla 6.2.0 shipped on 13 October 2026 with the 6.1 requirements, no documented breaking changes and no security fixes. What is new and which sites can update.
Phoca Cart 6.1.9 stops anyone downloading other customers' paid files
Phoca Cart before 6.1.9 let anonymous visitors download the digital products other customers bought. Only the Joomla 6 line is fixed, and 6.1.8 is affected.
Quix Page Builder 6.3.4 Fixes Guest Access and Editor Code Execution Flaws
Quix Page Builder 6.3.4 stops guests changing Quix settings or reading restricted pages, and editors running code on the server. Update every Joomla site.
JCTables for Joomla: Unauthenticated SQL Injection Fixed in 1.21.1
CVE-2026-76570 lets anyone read and rewrite a Joomla database through the JCTables extension without logging in. Scored 10.0 Critical, fixed in 1.21.1.
Event Gallery 6.5.0 Hides Eight Security Fixes in 46 Bug Fixes
Event Gallery 6.5.0 fixes five CVEs in Joomla, led by a Clear Cache path traversal (CVE-2026-97164). The vendor's notes now lead with security.
YouTube Gallery for Joomla: Unauthenticated SQL Injection Fixed in 5.7.3
CVE-2026-94130: an unauthenticated SQL injection in JoomlaBoat's YouTube Gallery for Joomla, scored 9.3 Critical. Every version below 5.7.3 is affected.
AcyMailing 11.1.0 Fixes Two Security Flaws
AcyMailing 11.1.0 fixes a mailbox file write and a file deletion flaw, now CVE-2026-94132 (9.5 Critical) and CVE-2026-94131, both filed under Bug fixes.
T4 Page Builder 2.3.0 Fixes an Unauthenticated Mail Relay
JoomlArt's T4 Page Builder 2.3.0 closes an unauthenticated open mail relay we reported in August. A week on, five in six installs we see are still older.
Release Radar, a Free Joomla and WordPress Release Tracker
A free public log of new Joomla and WordPress extension releases, including the paid ones no plugin directory covers. RSS and JSON, no account needed.
Phoca Cart 5.2.4, 6.1.7 and 4.0.13 fix a front-end SQL injection
Phoca Cart 5.2.4, 6.1.7 and 4.0.13 patch an unauthenticated SQL injection in the Joomla extension's product filter. Joomla 5 on 6.x isn't offered it.
Twenty Rules for Joomla Extension Developers Handling a Security Report
A new Joomla Manual page sets out 20 rules for how extension developers should handle a security report. Republished here in full under the JEDL.
JCE 2.9.99.10 Fixes Another Security Issue
JCE 2.9.99.10 patches a file rename flaw letting a privileged user create a hidden file in the folder they were browsing. The release hardens more too.
Joomla Update Error 999: a Dead Extension Redirecting to LinkedIn
The Joomla 'Invalid status code 999' update error is an abandoned extension whose update site redirects to LinkedIn. Here is the fix.
A New mySites.guru Tool to Find, and Fix, the JCE Profiles Hack (June 2026)
The JCE profiles hack exploits CVE-2026-48907, fixed in JCE 2.9.99.5. mySites.guru finds rogue profiles and webshells on every Joomla site. Patch to 2.9.99.11.
JCE Pro 2.9.99.6 Is a Hardening Release After a Full Audit of Joomla's Most-Installed Editor
JCE Pro 2.9.99.6 follows a four-day security audit of the editor, narrowing entry points and hardening input validation. Recommended for every JCE site.
JCE Free/Pro 2.9.99.5 Patches an Unauthenticated File Upload in Joomla's Most-Installed Editor
JCE Free and JCE Pro 2.9.99.5 patch an unauthenticated editor profile upload that could upload arbitrary files. Update every Joomla site running JCE.
JCE Free/Pro 2.9.99.4 Patches Two Authenticated Vulnerabilities in Joomla's Most Popular Editor
JCE Free and JCE Pro 2.9.99.4 patch an Editor Profile authentication bypass and a directory traversal in filesystem search. Update JCE today.
How to Enable Joomla Extension Auto-Updates Safely
How to enable auto-updates for Joomla extensions across one site or hundreds, with backup and rollback steps that keep client sites safe if an update breaks.
Joomla's Compat Plugin Is a Crutch, Not a Fix
Joomla's backward compatibility plugins keep broken extensions alive. Why that's technical debt, how to test without them, and how to recover.
Automatic Updates for Any Joomla Extension
Enable automatic updates for any Joomla extension that uses a Joomla update site - set per-site or across all connected sites with two clicks.
Install Extensions to Multiple Joomla Sites
Push a Joomla extension install to hundreds of sites simultaneously from the mySites.guru dashboard, with full success and failure notifications per site.
Update Joomla, WordPress and Every Plugin Across All Your Sites
How to update Joomla and WordPress core, extensions and plugins across all your sites from one page: security fixes first, back up, queue, snooze, verify.
Auto-Upgrade 1000s of Plugins & Extensions
Update Joomla extensions, WordPress plugins, and CMS cores across all your sites from one mySites.guru dashboard. Tick the sites, click Upgrade, done.
Install Extensions to 1000+ Sites at Once
Install any Joomla extension or WordPress plugin across 1,000 sites in one go using the mySites.guru bulk install tool - no SSH or FTP needed.
Manage all your Joomla Sites Extensions with mySites.guru
View, search and update every Joomla extension across all your connected sites from a single page in mySites.guru.
Top 50 Joomla Extensions in 2026
Real-time ranking of the top 50 most-installed Joomla extensions, pulled live from the mySites.guru database of 90,000+ connected sites.