Responsible Disclosure
A complete list of vulnerabilities we found and responsibly reported
129 CVEs where Phil E. Taylor / mySites.guru found and reported: 15 in Joomla core and 114 across 26 third-party extensions, from 2018 to 2026. This is what we found and reported to the developer, not what we wrote about, so it leaves out flaws others reported that we only covered. Some name us on the CVE record; others were fixed and numbered with no credit at all. Two are shared credits, where someone else found the other half of the same flaw, and those rows say so.
Every one of these came out of our own investigation work: auditing an extension after a customer's site was hacked, or reading code we could see running across the sites we manage. When we find something, it goes to the developer privately first and we publish only once a fixed release is available, so site owners have somewhere to update to on the day they read about it.
The other half of that exchange belongs to the developer receiving the report. Joomla's official developer documentation now sets out twenty rules for handling a security report, written by David Jardin of the Joomla Security Strike Team, the team that operates Joomla's CVE Numbering Authority. It is his work and the Joomla Project's, not ours; we republished it in full under the JEDL and added what it looks like from the reporting side. A published security contact is the single rule that changes the most, because it works before anything has gone wrong.
We currently have 5 more vulnerabilities inside their responsible disclosure embargo, with details to follow once each vendor has shipped a fix. Subscribe to the newsletter to get alerts if you are not already a mySites.guru subscriber.
| CVE | Product | Severity | What it was |
|---|---|---|---|
| CVE-2026-90901 | EasyStoreJoomShaper | 8.6 High | Authenticated SQL injection in EasyStore media image deletion (com_easystore); an administrator session can read or change anything in the site database Read the write-up |
| CVE-2026-90904 | EasyStoreJoomShaper | 8.6 High | ACL bypass in EasyStore administrator API record editing (com_easystore); allowEdit() always returned true, so any administrator could edit records Joomla's asset permissions should stop them editing Read the write-up |
| CVE-2026-90899 | EasyStoreJoomShaper | 8.2 High | Unauth guest checkout IDOR in EasyStore (com_easystore); any visitor who supplies a guest customer's email address gets back their name, street address, city, postcode, country and phone number Read the write-up |
| CVE-2026-90902 | EasyStoreJoomShaper | 8.2 High | Authenticated SQL injection in EasyStore coupon bulk update (com_easystore), reached through the coupon ids; only reachable from an administrator session despite the record's PR:N vector Read the write-up |
| CVE-2026-90903 | EasyStoreJoomShaper | 7.2 High | Missing CSRF token verification across the EasyStore administrator AJAX API (com_easystore); a hostile page can make a logged-in administrator change products, orders, customers and settings Read the write-up |
| CVE-2026-90905 | EasyStoreJoomShaper | 7.2 High | Missing CSRF and access control checks on EasyStore site configuration updates (com_easystore); a hostile page can rewrite the site's mail sender name and address in configuration.php Read the write-up |
| CVE-2026-90900 | EasyStoreJoomShaper | 5.3 Medium | Missing CSRF token verification on EasyStore storefront product reviews (com_easystore); a hostile page can post reviews in the name of any logged-in customer who visits it Read the write-up |
| CVE-2026-82191 | J2Store / J2Commercej2commerce.com | 5.3 Medium | Reflected parameter injection in J2Store (com_j2store); the standalone PayPal notify.php entry point bypasses Joomla's component dispatch and concatenates every $_REQUEST key/value pair, GET, POST and COOKIE, into the query string of the redirect it issues to the checkout controller with no encoding, so an &, = or # in an attacker-supplied field is parsed as new query syntax and injects parameters into the follow-up request Read the write-up |
| CVE-2026-82190 | J2Store / J2Commercej2commerce.com | 6.3 Medium | Predictable order access token in J2Store (com_j2store); the per-order bearer token guarding guest order lookup and digital-download authorization is a keyed hash of the site-wide Joomla secret and a guessable order id rather than randomly generated, and is never rotated after creation, so anyone who learns that secret mints a valid access token for every order on the site Read the write-up |
| CVE-2026-82189 | J2Store / J2Commercej2commerce.com | 8.7 High | Unauthenticated order-status tampering in J2Store (com_j2store); a failed PayPal IPN signature check is passed into _processSale() as an ordinary $errors entry rather than stopping processing, and the presence of any error makes it call update_status(3) on whatever order id the request's custom field names, with no check on the order's current state, so an anonymous forged IPN flips any pending, confirmed or shipped order to FAILED Read the write-up |
| CVE-2026-81568 | J2Store / J2Commercej2commerce.com | 8.7 High | Path-traversal arbitrary file read in J2Store (com_j2store); J2StoreModelOrderdownloads::getFilePath() concatenates the configured attachment folder with the stored product_file_save_name using only JPath::clean(), which normalises separators without resolving or rejecting .. segments, and never confirms the resolved path stays inside that folder, so a customer holding a valid download token retrieves configuration.php and any other file readable by the web server Read the write-up |
| CVE-2026-81567 | J2Store / J2Commercej2commerce.com | 8.7 High | Unauthenticated blind SQL injection in J2Store (com_j2store); the storefront product and product-tags list models build the product_type IN (...) fragment by wrapping each product_types[] request value in literal quotes and imploding them, with no escaping and no check that the values are valid product-type keys, so an anonymous visitor closes the string early and reads arbitrary database content by boolean or time-based inference Read the write-up |
| CVE-2026-78081 | J2Store / J2Commercej2commerce.com | 7.1 High | Incomplete CSRF protection in J2Store (com_j2store); none of the checkout controller's flow-advancing actions nor the my-profile saveAddress() validated an anti-CSRF token and the matching templates emitted their forms without one, so a forged cross-site request riding a victim's active checkout session silently overwrites the billing or shipping address before order confirmation Read the write-up |
| CVE-2026-81566 | SP Page BuilderJoomShaper | 5.1 Medium | Editor-level Joomla menu privilege escalation (com_sppagebuilder); the add-to-menu action called the menu-item model directly and skipped the com_menus permission check, so an Editor could create menu items or overwrite an existing one including the site home item; published 2026-09-14 as CWE-284, affected 4.0.0 to 6.9.0, credited to Phil Taylor, mysites.guru. JoomShaper's 6.9.1 changelog attaches this id to the media upload fix instead; the record is the authority Read the write-up |
| CVE-2026-81565 | SP Page BuilderJoomShaper | 6.9 Medium | Author-level file write into unintended directories of the web-root media tree (com_sppagebuilder); the upload endpoint took its destination folder from the request without confining it to the configured media folders; it cannot escape the web root and the extension allowlist blocks php/phtml/phar, so it is a missing-confinement bug rather than an RCE; published 2026-09-14 as CWE-22, affected 4.0.0 to 6.9.0, credited to Phil Taylor, mysites.guru. JoomShaper's 6.9.1 changelog attaches this id to the menu fix instead; the record is the authority Read the write-up |
| CVE-2026-81564 | SP Page BuilderJoomShaper | 7.0 High | Editor-level arbitrary file rename escaping the media folders (com_sppagebuilder); the rename endpoint took its target path from the request with no confinement, proven with a canary one level above JPATH_ROOT; the vendor's own fix comment records that an internal commit on 7 September had reverted an earlier fix for the same issue, a day before we reported it; published 2026-09-14 as CWE-22, affected 4.0.0 to 6.9.0, credited to Phil Taylor, mysites.guru Read the write-up |
| CVE-2026-79701 | SP Page BuilderJoomShaper | 6.9 Medium | Unauthenticated captcha bypass in all three SP Page Builder Pro form addons when the request claims the form is rendered inside a module; view_type came from the request and overwrote the captcha plugin's real verdict with a non-empty-string test, so any junk token passed; reported on the retest of the vendor's first fix build, which had left this route open; published 2026-09-14 as CWE-807, affected Pro 3.2.6 to 6.9.0, credited to Phil Taylor, mysites.guru Read the write-up |
| CVE-2026-79700 | SP Page BuilderJoomShaper | 6.9 Medium | Unauthenticated captcha bypass in the SP Page Builder Pro opt-in form addon; captcha_type, captcha_question and captcha_answer all came from the request, so both operands of the comparison belonged to the attacker and a form configured for reCAPTCHA could be downgraded to the question captcha; the same pattern we noted in ajax_contact during the 6.7.1 round, left in the sibling file when its two siblings were fixed in 6.9.0; published 2026-09-14 as CWE-807, affected Pro 5.1.4 to 6.9.0, credited to Phil Taylor, mysites.guru Read the write-up |
| CVE-2026-78375 | SP Page BuilderJoomShaper | 8.6 High | Author-level blind SQL injection in the com_content integration plugin (plg_content_sppagebuilder); a value from the article-save request reached the WHERE clause with no integer cast, one line below a cast that was present, so any account that can save an article, an Author by default, reads the whole database by timing oracle including the Super User password hash; published 2026-09-14 as CWE-89, affected 5.2.1 to 6.9.0, credited to Phil Taylor, mysites.guru; our own read was 7.1 High on a read-only vector, the record scores it 8.6 with VI:H/VA:H Read the write-up |
| CVE-2026-78071 | DPCalendarDigital Peak / Allon Moritz | 7.5 High | Authenticated stored XSS via an unescaped location title in a data-title attribute (com_dpcalendar); the 10.12.0 fix escaped nine of ten sinks and we found the tenth (shared credit with Toan Le, never cite as a solo find) Read the write-up |
| CVE-2026-78374 | T4 Page BuilderJoomlArt | 6.9 Medium | Unauthenticated open mail relay in the front-end contact endpoint (com_t4pagebuilder); the contact action was exempt from the component's ACL checks and sent mail to an attacker-supplied recipient using the site's own sender identity, with no form token and no rate limiting; published by the Joomla CNA crediting no reporter Read the write-up |
| CVE-2026-78082 | SP Property FinderJoomShaper | 9.3 Critical | Unauthenticated blind SQL injection in the public property search and map views (com_spproperty); several filter values were concatenated into the query with no quoting, letting an anonymous visitor read the entire Joomla database, password hashes and the site secret included. Read-only; the Joomla CNA rates it 9.3 Critical, we assess the read-only injection at 8.7 High Read the write-up |
| CVE-2026-78075 | Helix Ultimatejoomshaper.com | 5.1 Medium | Authenticated broken object-level authorization in blog image deletion (helixultimate); Blog::remove_image() checks whether the caller may edit the article id in the request but never confirms the supplied src path belongs to that article, so an author who owns one article deletes arbitrary files under /images/ on Joomla 3 builds |
| CVE-2026-60034 | JMediaThemeXpert | 9.4 Critical | Stored XSS via unsanitised SVG served without nosniff - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-60033 | JMediaThemeXpert | 5.1 Medium | SSRF via remote-URL download to internal / reserved addresses - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-60032 | JMediaThemeXpert | 9.4 Critical | Authenticated arbitrary file upload to RCE via polyglot/executable - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-60031 | Quix Page Builder ProThemeXpert | 6.9 Medium | Information disclosure: raw exceptions reflected in AJAX responses (com_quix) - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-60030 | Quix Page Builder ProThemeXpert | 8.7 High | Improper access control: media upload regardless of permissions (com_quix) - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-60029 | Quix Page Builder ProThemeXpert | 5.1 Medium | Authenticated stored XSS via id/class fields, rendered publicly (com_quix) - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-60028 | Quix Page Builder ProThemeXpert | 8.6 High | Authenticated stored XSS via element content and icon field (com_quix) - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-60027 | Quix Page Builder ProThemeXpert | 8.7 High | Unauthenticated path traversal / arbitrary file read via Form elements (com_quix) - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-60026 | Quix Page Builder ProThemeXpert | 8.9 High | Authenticated PHP code execution via Raw HTML element content (com_quix) - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-78303 | SP Property FinderJoomShaper | 6.9 Medium | Unauthenticated mail relay on the property booking and contact forms (com_spproperty); the recipient came from the request, so the site could be made to send mail to any address with a spoofed sender. Our find; the CNA record names no reporter Read the write-up |
| CVE-2026-78069 | J2Store / J2Commercej2commerce.com | 9.5 Critical | Authenticated (any backend account) missing authorization on the Apps controller delegation chain (com_j2store); appTask instantiates app-plugin controllers with no com_j2store ACL check anywhere, and the backend node of fof.xml declares no view ACL at all, so the framework defaults an unmatched task to allow. Any account able to log into the Joomla administrator, holding no J2Store permission whatsoever, reaches table truncation and traversal-based SQL file execution Read the write-up |
| CVE-2026-78065 | J2Store / J2Commercej2commerce.com | 7.1 High | Authenticated guest-checkout address disclosure in J2Store (com_j2store); editAddress() redirects a non-owner only when the loaded row has a non-empty user_id, and guest-checkout rows have none, so any logged-in account enumerating address_id is shown a guest customer's full name, street address and phone prefilled into the edit form Read the write-up |
| CVE-2026-78064 | J2Store / J2Commercej2commerce.com | 8.8 High | Unauthenticated cart-record tampering in J2Store (com_j2store); fof.xml grants the carts view a wildcard true ACL and the framework enforces CSRF only on backend HTML requests, so an anonymous format=raw POST inserts cart rows with an attacker-chosen user_id or session_id, or overwrites an existing row by id Read the write-up |
| CVE-2026-78000 | J2Store / J2Commercej2commerce.com | 5.3 Medium | Unauthenticated reflected XSS in J2Store (com_j2store) via filter_tag, pricefrom and priceto; J2Html::input()'s hidden branch echoes the value unescaped into the attribute across all six shipped product-tags template families, so a crafted link fires script on page open Read the write-up |
| CVE-2026-77999 | J2Store / J2Commercej2commerce.com | 8.7 High | Unauthenticated PayPal payment-callback forgery in J2Store (com_j2store); _validateIPN() accepts UNVERIFIED and anything not literally INVALID, runs with SSL peer verification disabled, and stores its verdict in a field nothing downstream reads, while omitting mc_gross skips the paid-amount check entirely, so an anonymous request confirms an unpaid order or fails a legitimate one Read the write-up |
| CVE-2026-77998 | miniOrange SAML SSOminiorange.com | 10.0 Critical | Unauth authentication bypass via SAMLResponse (com_miniorange_saml); validateSignature() tests the tri-state return of openssl_verify() as a boolean, so the -1 error value reads as a valid signature a Read the write-up |
| CVE-2026-77992 | Fabrikfabrikar.com | 9.5 Critical | Heredoc escaping breakout in calc element Read the write-up |
| CVE-2026-77991 | JEM - Joomla Event Managerjoomlaeventmanager.net | 9.4 Critical | Privileged RCE, administrator source model writes PHP Read the write-up |
| CVE-2026-77990 | JEM - Joomla Event Managerjoomlaeventmanager.net | 5.3 Medium | Attendee lists readable by any logged-in user Read the write-up |
| CVE-2026-77989 | JEM - Joomla Event Managerjoomlaeventmanager.net | 5.3 Medium | Reflected XSS via the PDF export link Read the write-up |
| CVE-2026-77035 | JEM - Joomla Event Managerjoomlaeventmanager.net | 5.1 Medium | Cross-user event and venue takeover via forged form fields Read the write-up |
| CVE-2026-77034 | JEM - Joomla Event Managerjoomlaeventmanager.net | 6.9 Medium | Unauth article overwrite and force-publish Read the write-up |
| CVE-2026-77029 | ZOOYOOtheme | 4.6 Medium | Missing CSRF tokens on front-end state changes, including submission deletion (com_zoo); scored PR:H Read the write-up |
| CVE-2026-77028 | ZOOYOOtheme | 5.3 Medium | Unauth reflected XSS and open redirect via the submission redirect parameter (com_zoo); the changelog mentions only the redirect half Read the write-up |
| CVE-2026-76612 | ZOOYOOtheme | 8.6 High | Unauth stored XSS (com_zoo); input in comments and in user-supplied field elements is not escaped on output, so a guest stores script that later runs in the browser of any viewer, administrators inclu Read the write-up |
| CVE-2026-76611 | ZOOYOOtheme | 6.9 Medium | Unauth arbitrary directory listing via the Gallery element in front-end submission (com_zoo); YOOtheme describe the same fix as a path traversal Read the write-up |
| CVE-2026-76610 | ZOOYOOtheme | 6.9 Medium | Unauth tag modification (com_zoo); the CNA records the comment controller endpoint as lacking ACL checks, so tags could be renamed or deleted with no login. The shipped 4.1.64 package also left the ad Read the write-up |
| CVE-2026-76609 | Fabrikfabrikar.com | 6.9 Medium | Unauth modification of any comment Read the write-up |
| CVE-2026-76608 | Fabrikfabrikar.com | 6.9 Medium | Unauth disclosure of any commenter's email Read the write-up |
| CVE-2026-76607 | Fabrikfabrikar.com | 10.0 Critical | Missing access check in download plugin FK branch Read the write-up |
| CVE-2026-76606 | Fabrikfabrikar.com | 10.0 Critical | Path traversal in image element Read the write-up |
| CVE-2026-76605 | Fabrikfabrikar.com | 10.0 Critical | Unauth RCE via image element with eval flag Read the write-up |
| CVE-2026-76604 | Fabrikfabrikar.com | 10.0 Critical | Unauth RCE via form_php _runPHP Read the write-up |
| CVE-2026-76603 | Fabrikfabrikar.com | 6.9 Medium | Unauth row disclosure via form.inlineedit Read the write-up |
| CVE-2026-76602 | Fabrikfabrikar.com | 9.3 Critical | Unauth SQLi in ORDER BY (CONCAT( allowlist bypass) Read the write-up |
| CVE-2026-76601 | Fabrikfabrikar.com | 6.9 Medium | Unauth row reordering (Order plugin) Read the write-up |
| CVE-2026-76600 | Fabrikfabrikar.com | 6.9 Medium | Unauth deletion of any comment Read the write-up |
| CVE-2026-76599 | Fabrikfabrikar.com | 8.7 High | Unauth database table list and table-prefix disclosure Read the write-up |
| CVE-2026-76598 | Fabrikfabrikar.com | 8.7 High | Unauth arbitrary directory listing (onAjax_getFolders) Read the write-up |
| CVE-2026-76597 | Fabrikfabrikar.com | 8.7 High | Unauth arbitrary file upload to web root (list email plugin) Read the write-up |
| CVE-2026-76596 | Fabrikfabrikar.com | 8.7 High | Unauth table truncation via list.doempty Read the write-up |
| CVE-2026-76571 | Fabrikfabrikar.com | 9.3 Critical | Unauth SQLi in list filter condition parameter Read the write-up |
| CVE-2026-75114 | ZOOYOOtheme | 5.1 Medium | Unauth open redirect in CommentController::twitterAuthenticate() (com_zoo); the referer parameter reaches setRedirect() with no scheme or host validation Read the write-up |
| CVE-2026-74804 | ZOOYOOtheme | 9.3 Critical | Unauth SQL injection in ItemController::element() (com_zoo); filter_type interpolated as a.type = "..." and type_filter as a.type IN ("..."), no quoting - bypasses state/access filters, full DB read b Read the write-up |
| CVE-2026-74803 | ZOOYOOtheme | 10.0 Critical | Unauth arbitrary file upload → RCE (com_zoo); the front-end submission Image element validates the client-supplied Content-Type only, never the file contents, and File::makeSafe preserves .php - a gue Read the write-up |
| CVE-2026-74254 | Page Builder CKjoomlack.fr | Unrated | Authenticated SQL injection in the styles handling (com_pagebuilderck); style ids concatenated into an IN (...) with no cast, payload fires when the page is rendered. The 3.6.4 release meant to fix it Read the write-up |
| CVE-2026-67286 | SP Page BuilderJoomShaper | 6.3 Medium | Unauth arbitrary directory creation and file write with a predefined name (com_sppagebuilder) Read the write-up |
| CVE-2026-67285 | SP Page BuilderJoomShaper | 9.2 Critical | Unauth arbitrary local PHP file inclusion via loadMoreCollectionData (com_sppagebuilder); pre-auth RCE, proved live Read the write-up |
| CVE-2026-67284 | Cotton CloudJonatas C. Ferreira / tabaoca.org | 5.3 Medium | Missing authorisation / cross-user IDOR (com_cotton); the authorisation half of the same disclosure, so a logged-in user reaches another user's stored files regardless of owner Read the write-up |
| CVE-2026-67283 | Cotton CloudJonatas C. Ferreira / tabaoca.org | 6.9 Medium | Unauth access to the whole file store (com_cotton): the login check sits in the view layer, so every task= endpoint is gated by a CSRF token alone, which Joomla issues to guests Read the write-up |
| CVE-2026-66915 | Fabrikfabrikar.com | 10.0 Critical | Unauth RCE in calc element (shared credit with Moe Khalilov and Kai Huang, never cite as a solo find) Read the write-up |
| CVE-2026-66490 | GridboxBalbooa | Unrated | Stored XSS via a comment avatar (com_gridbox) Read the write-up |
| CVE-2026-66489 | GridboxBalbooa | Unrated | Unauth file system disclosure, several vectors (com_gridbox) Read the write-up |
| CVE-2026-66488 | GridboxBalbooa | Unrated | Payment bypass (com_gridbox) Read the write-up |
| CVE-2026-65947 | GridboxBalbooa | Unrated | CSRF across the admin interface, several vectors (com_gridbox) Read the write-up |
| CVE-2026-65890 | GridboxBalbooa | 9.2 Critical | Unauth SQL injection, multiple vectors (com_gridbox) Read the write-up |
| CVE-2026-65889 | GridboxBalbooa | 9.2 Critical | Unauth recursive directory deletion (com_gridbox); generateNewApp deletes directory trees Read the write-up |
| CVE-2026-65888 | GridboxBalbooa | 10.0 Critical | Unauth account takeover (com_gridbox); socialLogin logs the caller in as any named user on the site Read the write-up |
| CVE-2026-65887 | GridboxBalbooa | 10.0 Critical | Unauth arbitrary password reset (com_gridbox); resetPassword resets any user's password, Super Users excepted, then logs in as them Read the write-up |
| CVE-2026-65886 | GridboxBalbooa | 9.2 Critical | Unauth arbitrary file read via the photo viewer (com_gridbox) Read the write-up |
| CVE-2026-65885 | GridboxBalbooa | 9.4 Critical | Authenticated arbitrary file upload (com_gridbox); chains with CVE-2026-65884 into unauthenticated RCE, which is how the CNA describes it Read the write-up |
| CVE-2026-65884 | GridboxBalbooa | 10.0 Critical | Unauth privilege escalation (com_gridbox); the registration method accepts a caller-supplied usergroup ID, so an anonymous visitor registers an account holding administrative permissions Read the write-up |
| CVE-2026-65879 | SP Page BuilderJoomShaper | Unrated | Unauth open mail relay from a product-wide hard-coded secret (com_sppagebuilder, CWE-798) Read the write-up |
| CVE-2026-65878 | SP Page BuilderJoomShaper | 8.3 High | Authenticated arbitrary file delete via traversal (com_sppagebuilder) Read the write-up |
| CVE-2026-65877 | SP Page BuilderJoomShaper | 8.2 High | Authenticated SQL injection in the media manager (com_sppagebuilder) Read the write-up |
| CVE-2026-65766 | SP Page BuilderJoomShaper | 9.2 Critical | Unauth SQL injection in the dynamic_content ORDER BY (com_sppagebuilder); anonymous full DB read Read the write-up |
| CVE-2026-65761 | EasyStoreJoomShaper | 9.3 Critical | Unauth SQL injection via filter_sortby ORDER BY (com_easystore); anonymous full DB read incl. password hashes Read the write-up |
| CVE-2026-65760 | EasyStoreJoomShaper | 9.2 Critical | Cross-customer order/invoice IDOR (com_easystore); logged-in customer reads any order's PII + printable invoice Read the write-up |
| CVE-2026-65759 | EasyStoreJoomShaper | 8.7 High | Unauth order/payment forgery via checkout.orderRepay (com_easystore); anonymous write of payment_status + arbitrary order fields Read the write-up |
| CVE-2026-63048 | Page Builder CKjoomlack.fr | 9.4 Critical | Authenticated arbitrary file upload → RCE (com_pagebuilderck); the 3.6.0 fix for CVE-2026-56290 gated the endpoint but left the extension allow-list commented out, so any core.edit account (default Ed Read the write-up |
| CVE-2026-63047 | Events BookingJoomDonation / Ossolution | Unrated | Unauth invoice IDOR (com_eventbooking); anonymous download of any registrant's PDF invoice - full name, organisation, postal address, email, amount paid - by walking the registration id Read the write-up |
| CVE-2026-61425 | GridboxBalbooa | 10.0 Critical | Unauth authentication bypass via an attacker-controlled cookie (com_gridbox) → Super User → RCE via template edit Read the write-up |
| CVE-2026-61424 | DJ-ClassifiedsDJ-Extensions.com | High | Unauth arbitrary file upload via the imageupload task (com_djclassifieds); web shell hidden in a valid image, RCE on misconfigured hosts Read the write-up |
| CVE-2026-60025 | Events BookingJoomDonation / Ossolution | Unrated | Missing CSRF token on the front-end file-upload endpoint (com_eventbooking) Read the write-up |
| CVE-2026-60024 | Events BookingJoomDonation / Ossolution | Unrated | Unauth media upload allowed by default (com_eventbooking); no login Read the write-up |
| CVE-2026-58149 | Events BookingJoomDonation / Ossolution | 6.9 Medium | Unauth user enumeration (IDOR) via get_profile_data (com_eventbooking); anonymous read of name + email for every user Read the write-up |
| CVE-2026-58078 | Quix Page Builder ProThemeXpert | 8.7 High | Unauth error-based SQL injection via a front-end element AJAX handler (com_quix); anonymous read of any DB table incl. password hashes Read the write-up |
| CVE-2026-57832 | EDocmanJoomDonation / Ossolution | 8.7 High | Unauth SQL injection via a public front-end endpoint (com_edocman); anonymous read of any DB table incl. password hashes Read the write-up |
| CVE-2026-57831 | DPCalendarDigital Peak / Allon Moritz | 8.7 High | Unauth blind SQL injection via filter_created_by on the public events feed (com_dpcalendar); anonymous read of any DB table Read the write-up |
| CVE-2026-57828 | Phoca Downloadphoca.cz / Jan Pavelka | 9.0 Critical | Authenticated member-upload allow-list bypass (com_phocadownload) → RCE Read the write-up |
| CVE-2026-57827 | RSFiles!rsjoomla.com | 10.0 Critical | Unauth file upload via front-end rsfiles.upload task (com_rsfiles) → RCE Read the write-up |
| CVE-2026-56292 | AcyMailingAcyba / acymailing.com | 8.7 High | Unauth SQL injection via public front-end endpoint (com_acym); anonymous read of any DB table incl. password hashes Read the write-up |
| CVE-2026-56291 | Balbooa Formsbalbooa.com | 10.0 Critical | Unauth file upload via form.uploadAttachmentFile (com_baforms) → RCE Read the write-up |
| CVE-2026-56290 | Page Builder CKjoomlack.fr | 10.0 Critical | Unauth file upload via browse.ajaxAddPicture (com_pagebuilderck) → RCE Read the write-up |
| CVE-2026-49049 | Helix3 frameworkJoomShaper | Unrated | Unauth com_ajax handler: arbitrary file delete / JSON write / template-param update (helix3) Read the write-up |
| CVE-2026-48939 | iCagendaicagenda.com | 10.0 Critical | Unauth file upload in event file-attachment feature → RCE Read the write-up |
| CVE-2026-48908 | SP Page BuilderJoomShaper | 10.0 Critical | Unauth file upload via asset.uploadCustomIcon → RCE Read the write-up |
| CVE-2026-23898 | Joomla! CMS coreJoomla! Project | 8.6 High | Arbitrary file deletion in com_joomlaupdate Read the write-up |
| CVE-2023-23755 | Joomla! CMS coreJoomla! Project | Medium | Bruteforce prevention within the MFA screen |
| CVE-2022-23799 | Joomla! CMS coreJoomla! Project | Low | Variable tampering on JInput $_REQUEST data |
| CVE-2022-23795 | Joomla! CMS coreJoomla! Project | Low | User row not bound to an authentication mechanism |
| CVE-2021-26034 | Joomla! CMS coreJoomla! Project | Low | CSRF in data download endpoints |
| CVE-2021-26033 | Joomla! CMS coreJoomla! Project | Low | CSRF in AJAX reordering endpoint |
| CVE-2021-23123 | Joomla! CMS coreJoomla! Project | Low | com_modules exposes module names |
| CVE-2020-35614 | Joomla! CMS coreJoomla! Project | Low | User enumeration in backend login |
| CVE-2020-35612 | Joomla! CMS coreJoomla! Project | Low | Path traversal in mod_random_image |
| CVE-2020-35610 | Joomla! CMS coreJoomla! Project | Low | com_finder ignores access levels on autosuggest |
| CVE-2020-15698 | Joomla! CMS coreJoomla! Project | Low | System Information screen could expose redis/proxy credentials |
| CVE-2020-15697 | Joomla! CMS coreJoomla! Project | Low | Variable tampering via user table class |
| CVE-2020-15696 | Joomla! CMS coreJoomla! Project | Low | Escape mod_random_image link |
| CVE-2019-18674 | Joomla! CMS coreJoomla! Project | Low | Path disclosure in phputf8 mapping files |
| CVE-2018-11327 | Joomla! CMS coreJoomla! Project | Medium | Information disclosure about unpublished tags |
| CVE-2026-97163 | UP (Universal Plugin)conseilgouz (formerly Lomart) | 10.0 Critical | Unauth remote code installation via on-demand GitHub action download (TLS checks off) Read the write-up |
| CVE-2026-97160 | UP (Universal Plugin)conseilgouz (formerly Lomart) | 9.4 Critical | PHP command injection via the php action, reachable by article authors through action-name variants Read the write-up |
| CVE-2026-97161 | UP (Universal Plugin)conseilgouz (formerly Lomart) | 9.2 Critical | Unauth path traversal: arbitrary file read (configuration.php) and file creation Read the write-up |
| CVE-2026-97162 | UP (Universal Plugin)conseilgouz (formerly Lomart) | 8.3 High | SQL injection vectors in the sql action and SQL-building actions Read the write-up |
A CVE links to our record page where we track a rule for it, and to cve.org otherwise. Joomla core issues are not tracked as extension rules, so those link out. Every one of these is also in the Joomla CVE index if it has a record.
SP Page Builder's Joomla 3 Security Patch Was Incomplete. Version 1.0.3 Fixes It.
JoomShaper's first Joomla 3 security patch for SP Page Builder left the captcha bypass live and the XSS fix incomplete. Version 1.0.3 closes both.
UP 6.1.0 fixes file read and code execution in the UP plugin for Joomla
Before UP 6.1.0, one anonymous request could read a Joomla site's configuration.php through the UP plugin, and any author could run PHP. We found it.
EasyStore 3.0.1 Fixes Seven Security Flaws mySites.guru Found in 3.0.0 on Release Day
Before EasyStore 3.0.1, any visitor could pull a Joomla shop customer's home address and phone number from their email. mySites.guru found it and six more.
Blind SQL Injection in Gridbox's Blog Author
Gridbox 2.20.3.1 fixes an unauthenticated blind SQL injection in the blog author parameter that can read a Joomla site's whole database. Update now.
Six more J2Store flaws fixed in 3.3.23, 4.0.23 and 4.1.8
J2Store 3.3.23, 4.0.23 and 4.1.8 fix six flaws mySites.guru reported, including an anonymous blind SQL injection that reads a Joomla shop's whole database.
SQL Injection and a Captcha Bypass in the SP Page Builder Joomla Extension, found by mySites.guru
mySites.guru found an Author-level SQL injection and an unauthenticated captcha bypass in the SP Page Builder Joomla extension, both fixed in 6.9.1.
Unauthenticated SQL Injection in SP Property Finder found by mySites.guru
mySites.guru found an unauthenticated blind SQL injection in JoomShaper's SP Property Finder. Any visitor could read the database. Fixed in 4.1.4.
T4 Page Builder 2.3.0 Fixes an Unauthenticated Mail Relay
JoomlArt's T4 Page Builder 2.3.0 closes an unauthenticated open mail relay we reported in August. A week on, five in six installs we see are still older.
J2Store 3.3.22, 4.0.22 and 4.1.7 fix five flaws we reported
J2Store 3.3.22, 4.0.22 and 4.1.7 fix five flaws mySites.guru reported, including anonymous PayPal order confirmation and a 9.5 backend escalation.
Five Security Issues in JEM (Joomla Event Manager), and No Stable Fix Yet
mySites.guru found and reported multiple security issues in JEM (Joomla Event Manager), including an unauthenticated article overwrite. No stable fix yet.
Unauthenticated Remote Code Execution in SP Page Builder found by mySites.guru
mySites.guru found a pre-authentication remote code execution flaw in SP Page Builder for Joomla, in the same release that fixed our earlier reports.
Cotton Cloud Patched the Login, Then the Data
Two access control flaws in Cotton Cloud for Joomla. The first fix closed the door, not the room. CVE-2026-67283 and CVE-2026-67284 are fixed in 2.0.3.
Twenty Rules for Joomla Extension Developers Handling a Security Report
A new Joomla Manual page sets out 20 rules for how extension developers should handle a security report. Republished here in full under the JEDL.
Another 23 Critical Security Vulnerabilities in Gridbox for Joomla
Balbooa asked mySites.guru to audit Gridbox for Joomla. We found 23 vulnerabilities, including a pre-auth RCE, some exploited already. Fixed in 2.20.2.
Pre-Authentication SQL Injection and Mail Relay in SP Page Builder found by mySites.guru
mySites.guru found four vulnerabilities in SP Page Builder for Joomla: a SQL injection and a mail relay, fixed in 6.7.1. A fifth was still there until 6.8.0.
Exposed Customer Invoices, Order Forgery and SQL Injection in EasyStore for Joomla found by mySites.guru
Before EasyStore 2.0.2, any logged-in customer could read every other customer's invoice by editing one URL. mySites.guru found this and two more flaws.
Events Booking for Joomla exposes personal and financial data from invoices
An unauthenticated flaw in Events Booking for Joomla let anyone download any registrant's invoice, with their name, address, email and payment. Fixed in 5.8.2.
Gridbox for Joomla: One Cookie and You Are a Super User
A critical unauthenticated authentication bypass in Gridbox for Joomla let anyone become a Super User by setting a single cookie. Fixed in 2.20.1. Update now.
Events Booking for Joomla: Anyone Could Upload Files to Your Server
mySites.guru found two unauthenticated flaws in Events Booking for Joomla: file upload enabled by default, and a leak of every user's name and email.
We Are Not the Only Ones Auditing Joomla Extensions
Two Joomla extension flaws went public via the Joomla CNA: a SQL injection in JoomCCK and a stored XSS in ChronoForms. Neither was ours. Update now.
Unauthenticated SQL Injection in Quix Page Builder found by mySites.guru
mySites.guru found and reported CVE-2026-58078, an unauthenticated SQL injection in Quix Page Builder for Joomla. Fixed in 6.2.1; update to 6.2.2.
Unauthenticated SQL Injection in EDocman found by mySites.guru
mySites.guru found an unauthenticated SQL injection in EDocman for Joomla that let anyone read the whole database. Fixed in 3.9.0 - update now.
Nineteen and Counting: Joomla Extension Vulnerabilities We Found and Disclosed in a Month
In just over a month mySites.guru found and responsibly disclosed nineteen security issues in popular Joomla extensions, most of them critical.
Unauthenticated SQL Injection in DPCalendar found by mySites.guru
mySites.guru found and reported an unauthenticated SQL injection in the DPCalendar Joomla extension's public events feed. Fixed in 10.11.2 and 8.19.4.
Unauthenticated SQL Injection in AcyMailing found by mySites.guru
mySites.guru found and reported CVE-2026-56292, an unauthenticated SQL injection in AcyMailing for Joomla and WordPress. Update to 10.11.1 now.