Joomla Vulnerability Database

These are the 343 vulnerability rules mySites.guru checks every connected Joomla site against, covering 204 extensions and 418 CVE-numbered vulnerabilities. A good number of them exist because we found the flaw ourselves and reported it to the developer before publishing.

Rules current as of 3 October 2026. Subscribers see which of their own sites are affected, on the site's Manage page.

Why no WordPress CVE or vulnerability data?

WordPress is covered by the service too: mySites.guru integrates Wordfence's vulnerability feed in full, mirroring the data published on Wordfence's vulnerability pages, and every connected WordPress site is checked against it on each audit. To research a WordPress plugin or theme yourself, search Wordfence's database directly.

Subscribe by RSS

New rules as we start checking sites against them. One item per rule, so a CVE needing a rule per Joomla branch appears once for each.

https://mysites.guru/vulnerabilities/rss.xml

Open feed

One item per CVE instead

This page is public. Acting on it across a portfolio is the mySites.guru subscription: each audit checks every connected Joomla and WordPress site against these rules, flags the ones running an affected version, and updates the extension in one click across all of them. One price, unlimited sites, 90,000+ sites protected in 14 years.

Check your sites free Read our disclosures

Extensions we track

Filter by severity, or search for the extension or CVE you're after. Browse every tracked CVE at the Joomla CVE index.

Extension	Rules	Severity	Latest	CVEs
Page Builder CKcom_pagebuilderck	10	Critical, High, Medium	2026-08-17	CVE-2026-74254 CVE-2026-77993 CVE-2026-77994 CVE-2026-63048 CVE-2026-62414 CVE-2026-56290
J2Store / J2Commercecom_j2store	9	Critical, High	2026-09-15	CVE-2026-78081 CVE-2026-81567 CVE-2026-81568 CVE-2026-82189 CVE-2026-82190 CVE-2026-82191 CVE-2026-77999 CVE-2026-78000 CVE-2026-78064 CVE-2026-78065 CVE-2026-78069 CVE-2026-67358 CVE-2026-67359 CVE-2026-67360 CVE-2026-67361 CVE-2026-67362 CVE-2026-74252 CVE-2020-13996
Phoca Cartcom_phocacart	7	Critical, High, Medium	2026-10-01	CVE-2026-74251 CVE-2026-76564 CVE-2026-76565
miniOrange SAML SSOcom_miniorange_saml	6	Critical, High	2026-08-31	CVE-2026-78074 CVE-2026-77998
Phoca Downloadcom_phocadownload	6	Critical, High, Medium	2026-07-10	CVE-2026-57828 CVE-2026-76569
miniOrange OAuth Clientcom_miniorange_oauth	4	Critical, High	2026-08-31	CVE-2026-78074 CVE-2026-77995
SP Page Buildercom_sppagebuilder	4	Critical, High	2026-09-14	CVE-2026-78375 CVE-2026-79700 CVE-2026-79701 CVE-2026-81564 CVE-2026-81565 CVE-2026-81566 CVE-2026-67285 CVE-2026-67286 CVE-2026-67287 CVE-2026-65876 CVE-2026-65766 CVE-2026-65877 CVE-2026-66494 CVE-2026-65878 CVE-2026-65879 CVE-2026-48908
Articles Anywherearticlesanywhere	3	Critical, High	2026-09-13	CVE-2026-85195 CVE-2026-85196 CVE-2026-64793 CVE-2026-64794 CVE-2026-64795 CVE-2026-64799 CVE-2026-65755
Balbooa Formscom_baforms	3	Critical	2026-09-29	CVE-2026-102425 CVE-2026-102424 CVE-2026-101127 CVE-2026-101112 CVE-2026-101126 CVE-2026-67364 CVE-2026-67363 CVE-2026-65880 CVE-2026-56291 CVE-2025-49485
Conditional Contentconditionalcontent	3	Critical, Medium	2026-09-13	CVE-2026-85192 CVE-2026-85188 CVE-2026-63280 CVE-2026-63281 CVE-2026-63683 CVE-2026-64792
Events Bookingcom_eventbooking	3	Critical, Medium	2026-07-20	CVE-2026-63047 CVE-2026-58149 CVE-2026-60024 CVE-2026-60025
Gridboxcom_gridbox	3	Critical, High	2026-09-21	CVE-2026-61425 CVE-2026-65884 CVE-2026-65885 CVE-2026-65889 CVE-2026-65890 CVE-2026-66488 CVE-2026-66489 CVE-2026-66490 CVE-2026-65886 CVE-2026-65887 CVE-2026-65888 CVE-2026-65947
Helix Ultimateshaper_helixultimate	3	Critical, High	2026-08-31	CVE-2026-78075 CVE-2026-78076 CVE-2026-78077 CVE-2026-78078 CVE-2026-78079 CVE-2026-57829 CVE-2026-57830
Helix Ultimate Frameworkhelixultimate	3	Critical, High	2026-08-31	CVE-2026-78075 CVE-2026-78076 CVE-2026-78077 CVE-2026-78078 CVE-2026-78079 CVE-2026-57829 CVE-2026-57830
iCagendacom_icagenda	3	Critical	2026-06-15	CVE-2026-48939 CVE-2026-67365 CVE-2026-71571 CVE-2026-67366 CVE-2026-71570
J-BusinessDirectorycom_jbusinessdirectory	3	Critical	2026-08-19	CVE-2026-75949 CVE-2026-75954 CVE-2026-75956 CVE-2026-75950 CVE-2026-75951 CVE-2026-75952 CVE-2026-75953 CVE-2026-75955 CVE-2020-5182 CVE-2019-25752
JCEcom_jce	3	Critical, High, Medium	2026-07-29	CVE-2026-65891 CVE-2026-48907 CVE-2015-7339
Modules Anywheremodulesanywhere	3	Critical, High	2026-09-27	CVE-2026-100750 CVE-2026-65757 CVE-2026-64793 CVE-2026-64795
Sourcerersourcerer	3	Critical, Low	2026-08-17	CVE-2026-74253 CVE-2025-22204 CVE-2026-64796
ZOOcom_zoo	3	Critical, High, Medium	2026-08-21	CVE-2026-76611 CVE-2026-76612 CVE-2026-77028 CVE-2026-77029 CVE-2026-76610 CVE-2026-74803 CVE-2026-74804 CVE-2026-75114
AcyMailingcom_acym	2	Critical	2026-09-24	CVE-2026-94132 CVE-2026-94131 CVE-2026-56292 CVE-2023-39970 CVE-2023-39971 CVE-2023-39972 CVE-2023-39973 CVE-2023-39974
Astroid Frameworkastroid	2	Critical	2026-03-05	CVE-2026-21628
Book Librarycom_booklibrary	2	Critical, Medium	2026-09-28	CVE-2026-101111 CVE-2026-101110
Easy Folder Listing Procom_easyfolderlistingpro	2	Critical	2024-11-26	CVE-2024-11145
Fabrikcom_fabrik	2	Critical, High	2026-08-22	CVE-2026-76571 CVE-2026-76596 CVE-2026-76597 CVE-2026-76598 CVE-2026-76600 CVE-2026-76601 CVE-2026-76602 CVE-2026-76603 CVE-2026-76604 CVE-2026-76605 CVE-2026-76606 CVE-2026-76607 CVE-2026-76608 CVE-2026-76609 CVE-2026-77027 CVE-2026-77992 CVE-2026-76599 CVE-2020-37219 CVE-2026-67282 CVE-2026-66915
jDownloadscom_jdownloads	2	Critical, Medium	2026-07-17	CVE-2026-61900 CVE-2025-55758 CVE-2022-27909
JEventscom_jevents	2	Critical	2025-01-01	CVE-2025-49467 CVE-2015-7340
K2com_k2	2	Critical, Medium	2026-06-25	CVE-2026-48941 CVE-2026-48942 CVE-2026-48943 CVE-2026-48944 CVE-2026-48945 CVE-2026-48946 CVE-2026-48940
OS CCKcom_os_cck	2	Critical, High	2026-09-30	CVE-2026-102427
OS Gallerycom_osgallery	2	Critical	2026-09-20	CVE-2026-88854 CVE-2026-88857 CVE-2026-88856 CVE-2026-88855
Real Estate Managercom_realestatemanager	2	Critical, Medium	2026-09-28	CVE-2026-100753 CVE-2026-100752
Smart Slider 3 Prosmartslider3	2	Critical, Medium	2026-04-08	CVE-2026-34424
UP Universal Pluginup	2	Critical	2026-09-26	CVE-2026-97160 CVE-2026-97161 CVE-2026-97162 CVE-2026-97163
Vehicle Managercom_vehiclemanager	2	Critical, Medium	2026-09-28	CVE-2026-101109 CVE-2026-101108
Aimy Captcha-Less Form Guardaimycaptchalessformguard	1	Critical	2026-07-28	CVE-2026-65883
Articles Calendarmod_articles_calendar	1	Critical	2025-07-18	CVE-2025-26855
Articles Calendararticlescalendar	1	Critical	2025-07-18	CVE-2025-26855
BrainCert Virtual Classroomcom_virtualclassroom	1	Critical	2023-08-07	CVE-2023-34477
Conditional Contentpkg_conditionalcontent	1	Critical	2026-09-13	CVE-2026-85192 CVE-2026-85188
Creative Contact Formcom_creativecontactform	1	Critical	2020-03-04	CVE-2014-8739 CVE-2020-9364
DJ-Classifiedscom_djclassifieds	1	Critical	2026-07-20	CVE-2026-61424 CVE-2025-54474
EDocmancom_edocman	1	Critical	2026-07-14	CVE-2026-57832
Helix3 Templateshaper_helix3	1	Critical	2026-06-29	CVE-2026-49049
JCTablescom_jctables	1	Critical	2026-09-30	CVE-2026-76570
JEM - Joomla Event Managercom_jem	1	Critical	2026-08-27	CVE-2026-77034 CVE-2026-77035 CVE-2026-77989 CVE-2026-77990 CVE-2026-77991
JooDatabasecom_joodb	1	Critical	2026-09-03	CVE-2026-78080
JoomCCKcom_joomcck	1	Critical	2026-07-17	CVE-2026-49048
LMS Litecom_lmslite	1	Critical	2023-12-14	CVE-2023-40629
Regular Labs GeoIPgeoip	1	Critical	2026-07-23	CVE-2026-65431 CVE-2026-64876 CVE-2026-65430 CVE-2026-64875
RSFiles!com_rsfiles	1	Critical	2026-07-10	CVE-2026-57827 CVE-2025-50057
RSForm!Procom_rsform	1	Critical	2025-01-01	CVE-2025-30085 CVE-2025-27444
SP LMScom_splms	1	Critical	2026-01-01	CVE-2026-48909
SP Property Findercom_spproperty	1	Critical	2026-09-10	CVE-2026-78082 CVE-2026-78303 CVE-2026-78083 CVE-2026-78084 CVE-2026-78302 CVE-2026-78085
Starshopcom_starshop	1	Critical	2023-12-14	CVE-2023-49708
Visitors Countermod_vvisit_counter	1	Critical	2025-10-03	CVE-2025-40636
YouTube Gallerycom_youtubegallery	1	Critical	2026-09-26	CVE-2026-94130
Snippetscom_snippets	9	High, Medium	2026-09-13	CVE-2026-88852 CVE-2026-63684 CVE-2026-64792 CVE-2026-63265
DPCalendarcom_dpcalendar	7	High, Medium	2026-08-28	CVE-2026-78071 CVE-2026-78070 CVE-2026-57831 CVE-2024-21727
YOOtheme Proyootheme	6	High, Medium	2026-08-25	CVE-2026-77997 CVE-2026-76613 CVE-2026-75115
Convert Formscom_convertforms	5	High	2026-07-23	CVE-2026-65758 CVE-2024-40744 CVE-2024-40745 CVE-2025-22212 CVE-2026-77026
Tabs & Accordionstabsaccordions	5	High, Medium	2026-09-27	CVE-2026-100751 CVE-2026-85191 CVE-2026-64792 CVE-2026-63265
Visformscom_visforms	4	High	-	CVE-2023-23753
Modalsmodals	3	High	2026-09-13	CVE-2026-85189 CVE-2026-88853 CVE-2026-65713
Quix Page Buildercom_quix	3	High	2026-07-15	CVE-2026-58078 CVE-2026-60026 CVE-2026-60027 CVE-2026-60028 CVE-2026-60029 CVE-2026-60030 CVE-2026-60031
EasyStorecom_easystore	2	High	2026-09-23	CVE-2026-90899 CVE-2026-90900 CVE-2026-90901 CVE-2026-90902 CVE-2026-90903 CVE-2026-90904 CVE-2026-90905 CVE-2026-65759 CVE-2026-65760 CVE-2026-65761
JoomGallerycom_joomgallery	2	High, Medium	2026-09-15	CVE-2026-84048 CVE-2026-66917 CVE-2026-66916
miniOrange LDAP Integrationcom_miniorange_dirsync	2	High	2026-08-31	CVE-2026-78074 CVE-2023-23749
Phoca Commandercom_phocacommander	2	High	2026-07-27	CVE-2026-65764 CVE-2026-65765 CVE-2025-54473 CVE-2026-66491 CVE-2026-66492 CVE-2026-66493
Quick Indexquickindex	2	High, Medium	2026-09-13	CVE-2026-85190 CVE-2026-63265
Sexy Polling Reloadedcom_sexypolling	2	High	2026-08-28	CVE-2026-78072
Snippetspkg_snippets	2	High	2026-09-13	CVE-2026-88852
Tabs & Accordionspkg_tabsaccordions	2	High	2026-09-27	CVE-2026-100751 CVE-2026-85191
Users Anywhereusersanywhere	2	High, Medium	2026-09-13	CVE-2026-85196 CVE-2026-64794 CVE-2026-64795 CVE-2026-64799 CVE-2026-65755
YOOtheme Prolocation	2	High	2026-08-25	CVE-2026-77996
4Analyticscom_foranalytics	1	High	2026-07-15	CVE-2026-58077 CVE-2026-57833
AcyMailingcom_acymailing	1	High	2020-03-09	CVE-2015-7338
Admiror Framesadmirorframes	1	High	2024-06-28	CVE-2024-5735 CVE-2024-5736 CVE-2024-5737
Articles Anywherepkg_articlesanywhere	1	High	2026-09-13	CVE-2026-85195 CVE-2026-85196
ChronoForms 8com_chronoforms8	1	High	2026-07-17	CVE-2026-58148
DPAttachmentscom_dpattachments	1	High	2026-09-10	-
DPAttachmentspkg_dpattachments	1	High	2026-09-10	-
DPCasescom_dpcases	1	High	2026-09-10	-
DPCasespkg_dpcases	1	High	2026-09-10	-
DPMedialib_dpmedia	1	High	2026-09-10	-
DPMediapkg_dpmedia	1	High	2026-09-10	-
Easy Shopcom_easyshop	1	High	2019-01-01	CVE-2019-25760
EasyDiscusscom_easydiscuss	1	High	2026-01-16	CVE-2026-21623 CVE-2026-21624 CVE-2026-21625 CVE-2026-21626
Event Gallerycom_eventgallery	1	High	2026-09-26	CVE-2026-97164 CVE-2026-97165 CVE-2026-100747 CVE-2026-100748 CVE-2026-100749
Event Registration Pro Calendarcom_registrationpro	1	High	2017-01-01	CVE-2017-20273
Extra Searchcom_extrasearch	1	High	2017-01-01	CVE-2017-20281
Flip Wallcom_flipwall	1	High	2026-06-19	CVE-2017-20265
Gurucom_guru	1	High	-	CVE-2022-23802
HDW Playercom_hdwplayer	1	High	2026-05-13	CVE-2020-37218
Ignite Gallerycom_igallery	1	High	2026-07-07	-
J-ClassifiedsManagercom_displayads	1	High	2019-01-01	CVE-2019-25751
J-MultipleHotelReservationcom_jmultiplehotelreservation	1	High	2019-01-01	CVE-2019-25750
jCartcom_jcart	1	High	2017-01-01	CVE-2017-20282
JHotelReservationcom_jhotelreservation	1	High	2019-01-01	CVE-2019-25748
jNewscom_jnews	1	High	2020-03-09	CVE-2015-7341 CVE-2015-7342 CVE-2015-7343
Jomrescom_jomres	1	High	2026-05-23	CVE-2013-3931 CVE-2013-3932 CVE-2018-25354
JoomCRMcom_joomcrm	1	High	2019-01-01	CVE-2019-25761
Joomdlecom_joomdle	1	High	2026-07-28	CVE-2026-65881 CVE-2026-65882
LMS King Professionalcom_lmsking	1	High	2017-01-01	CVE-2017-20274
miniOrange Custom APIcom_miniorange_customapi	1	High	2026-08-31	CVE-2026-78074
miniOrange Import Export Userscom_miniorange_importexportusers	1	High	2026-08-31	CVE-2026-78074
miniOrange Keycloak User Synccom_miniorange_keycloaksync	1	High	2026-08-31	CVE-2026-78074
miniOrange Restrict Files / Folderscom_miniorange_mediarestriction	1	High	2026-08-31	CVE-2026-78074
miniOrange SCIM User Provisioningcom_miniorange_scim	1	High	2026-08-31	CVE-2026-78074
miniOrange Two Factor Authenticationcom_miniorange_twofa	1	High	2026-08-31	CVE-2026-78074
Modalspkg_modals	1	High	2026-09-13	CVE-2026-85189 CVE-2026-88853
Modules Anywherepkg_modulesanywhere	1	High	2026-09-27	CVE-2026-100750
MyPortfoliocom_myportfolio	1	High	2017-01-01	CVE-2017-20280
OS Propertycom_osproperty	1	High	2026-08-09	-
paGO Commercecom_pago	1	High	2020-09-18	CVE-2020-25751
PHP-Bridgecom_phpbridge	1	High	2017-01-01	CVE-2017-20275
Quantum Managercom_quantummanager	1	High	2025-08-25	CVE-2025-54300 CVE-2025-54301
Quick Indexpkg_quickindex	1	High	2026-09-13	CVE-2026-85190
Regular Labs DB Replacercom_dbreplacer	1	High	2026-07-22	CVE-2026-63685 CVE-2026-63265
Regular Labs Extension Managercom_regularlabsmanager	1	High	2026-07-22	CVE-2026-64791 CVE-2026-63265
Regular Labs IP Loginiplogin	1	High	2026-07-22	CVE-2026-64797 CVE-2026-64798 CVE-2026-63265
RO CSVIcom_csvi	1	High	2026-07-28	CVE-2026-65943 CVE-2026-65944 CVE-2026-65946
S5 Registermod_s5_register	1	High	2023-12-14	CVE-2023-49707
StreetGuessr Gamecom_streetguess	1	High	2017-01-01	CVE-2017-20271
Survey Force Deluxecom_surveyforce	1	High	2026-06-19	CVE-2017-20256
T4 Page Buildercom_t4pagebuilder	1	High	2026-08-28	CVE-2026-78374
Twitch TVcom_twitchtv	1	High	2017-01-01	CVE-2017-20270
Ultimate Property Listingcom_upl	1	High	2017-01-01	CVE-2017-20272
vAccountcom_vaccount	1	High	2019-01-01	CVE-2019-25756
vBizzcom_vbizz	1	High	2019-01-01	CVE-2019-25758 CVE-2019-25759
VMapcom_vmap	1	High	2019-01-01	CVE-2019-25753
vReviewcom_vreview	1	High	2019-01-01	CVE-2019-25755
vWishlistcom_vwishlist	1	High	2019-01-01	CVE-2019-25757
Content Templatercom_contenttemplater	5	Medium	2026-09-13	CVE-2026-85188 CVE-2026-63684 CVE-2026-63280 CVE-2026-63281 CVE-2026-63683
Advanced Module Manageradvancedmodules	4	Medium	2026-09-13	CVE-2026-85188 CVE-2026-63280 CVE-2026-63281 CVE-2026-63683 CVE-2026-63265
ReReplacercom_rereplacer	4	Medium	2026-09-13	CVE-2026-85188 CVE-2026-65754 CVE-2026-63684 CVE-2026-63280 CVE-2026-63281
JoomShoppingcom_jshopping	2	Medium, Low	2026-07-22	CVE-2026-63264 CVE-2025-22211
Phoca Mapscom_phocamaps	2	Medium	2026-07-23	CVE-2026-65763 CVE-2026-23900
Advanced Module Managerpkg_advancedmodules	1	Medium	2026-09-13	CVE-2026-85188
All Video Sharecom_allvideoshare	1	Medium	2026-08-28	CVE-2026-78073
Balbooa Gallerycom_bagallery	1	Medium	2025-07-18	CVE-2025-49486 CVE-2023-23757
Balbooa Gallerycom_gallery	1	Medium	2026-08-18	-
Booking - Book Itcom_booking	1	Medium	2023-01-01	CVE-2023-54357
CCommentcom_comment	1	Medium	2025-07-23	CVE-2025-54297
Clicky Analytics Dashboardmod_clicky_dash	1	Medium	2023-12-14	CVE-2023-40658
Content Templaterpkg_contenttemplater	1	Medium	2026-09-13	CVE-2026-85188
DJ-HelpfulArticlescom_djhelpfularticles	1	Medium	2024-07-09	CVE-2024-27183
Easy Quick Contactmod_easyquickcontact	1	Medium	2023-12-14	CVE-2023-40659
iProperty Real Estatecom_iproperty	1	Medium	2026-04-09	CVE-2023-54361
JLex Reviewcom_jlexreview	1	Medium	2026-04-09	CVE-2023-54360
JoomProjectcom_jpprojects	1	Medium	2019-01-01	CVE-2019-25762
JS Jobscom_jsjobs	1	Medium	2026-06-04	CVE-2019-25740 CVE-2018-25327 CVE-2025-22206 CVE-2025-22208 CVE-2025-22209 CVE-2025-49484 CVE-2025-54475
LivingWordcom_livingword	1	Medium	2023-12-14	CVE-2023-40627
Membership Procom_osmembership	1	Medium	2026-07-21	CVE-2026-62415
oneVotecom_onevote	1	Medium	2023-07-11	CVE-2023-23756
osTicky2com_osticky2	1	Medium	2024-02-15	CVE-2024-21728
Phoca Guestbookcom_phocaguestbook	1	Medium	2026-07-23	CVE-2026-65762
Regular Labs Better Frontend Linkmod_betterfrontendlink	1	Medium	2026-07-22	CVE-2026-63265
Regular Labs CDNcdnforjoomla	1	Medium	2026-07-22	CVE-2026-65712 CVE-2026-63265
Regular Labs Email Protectoremailprotector	1	Medium	2026-07-22	CVE-2026-63265
ReReplacerpkg_rereplacer	1	Medium	2026-09-13	CVE-2026-85188
RSBlog!com_rsblog	1	Medium	2025-01-01	CVE-2025-50126 CVE-2025-27754
Solidrescom_solidres	1	Medium	2026-04-09	CVE-2023-54363
Users Anywherepkg_usersanywhere	1	Medium	2026-09-13	CVE-2026-85196
VirtueMartcom_virtuemart	1	Medium	2026-04-09	CVE-2023-54362 CVE-2025-25228 CVE-2025-55757
XCloner Backupcom_xcloner-backupandrestore	1	Medium	2020-05-23	CVE-2020-13424
HikaShopcom_hikashop	1	Low	2026-07-20	CVE-2026-61901 CVE-2023-38044 CVE-2024-40746 CVE-2025-22210 CVE-2025-25225 CVE-2015-7344
SEBLODcom_cck	3	Unrated	-	CVE-2026-66914
Cache Cleanercachecleaner	2	Unrated	-	CVE-2026-64871 CVE-2026-64872 CVE-2026-64873 CVE-2026-64874
Cotton Cloudcom_cotton	2	Unrated	-	CVE-2026-67283 CVE-2026-67284
Admiror Gallerycom_admirorgallery	1	Unrated	-	CVE-2025-22205 CVE-2023-38045
Ajax Quizcom_ajaxquiz	1	Unrated	-	CVE-2017-20262
Cache Cleanerpkg_cachecleaner	1	Unrated	-	CVE-2026-64871 CVE-2026-64872 CVE-2026-64873 CVE-2026-64874
CommentBoxcom_commentbox	1	Unrated	-	CVE-2025-54298
Creative Gallerycom_creativegallery	1	Unrated	-	CVE-2023-23758
DJ-Flyercom_djflyer	1	Unrated	-	CVE-2025-50127
DJ-Reviewscom_djreviews	1	Unrated	-	CVE-2025-54295
DOCmancom_docman	1	Unrated	-	CVE-2022-27910
eXtplorercom_extplorer	1	Unrated	-	CVE-2023-40628
FocalPointcom_focalpoint	1	Unrated	-	CVE-2017-20263
iCagenda Calendar modulemod_icagenda_calendar	1	Unrated	-	CVE-2026-67365
JCDashboardscom_jcdashboards	1	Unrated	-	CVE-2023-40630
JMediacom_jmedia	1	Unrated	-	CVE-2026-60032 CVE-2026-60033 CVE-2026-60034
JoomDOCcom_joomdoc	1	Unrated	-	CVE-2023-40657
Joomla Quiz Deluxecom_joomlaquiz	1	Unrated	-	CVE-2017-20257
JoomRecipecom_joomrecipe	1	Unrated	-	CVE-2017-20277 CVE-2017-20278
Keyboard Shortcutskeyboardshortcuts	1	Unrated	-	CVE-2026-65756
Komentocom_komento	1	Unrated	-	CVE-2025-54294
No Boss Calendarcom_nobosscalendar	1	Unrated	-	CVE-2025-49468
No Boss Testimonialscom_nobosstestimonials	1	Unrated	-	CVE-2025-54299
OSDownloadscom_osdownloads	1	Unrated	-	CVE-2017-20259
Payagecom_payage	1	Unrated	-	CVE-2017-20279
ProFilescom_profiles	1	Unrated	-	CVE-2025-54296
Proforms Basiccom_proforms	1	Unrated	-	CVE-2023-34476 CVE-2023-40655
QuickFormcom_quickform	1	Unrated	-	CVE-2023-40656
RSDirectory!com_rsdirectory	1	Unrated	-	CVE-2025-50058
RSFirewall!com_rsfirewall	1	Unrated	-	CVE-2025-27445
RSMail!com_rsmail	1	Unrated	-	CVE-2025-50056 CVE-2025-30084
RSMediaGallery!com_rsmediagallery	1	Unrated	-	CVE-2025-27753 CVE-2025-32466
RSTickets! Procom_rsticketspro	1	Unrated	-	CVE-2025-32465
SIMGenealogycom_simgenealogy	1	Unrated	-	CVE-2017-20276
SP Movie Databasecom_spmoviedb	1	Unrated	-	CVE-2017-20266
Sponsor Wallcom_sponsorwall	1	Unrated	-	CVE-2017-20264
Tooltipstooltips	1	Unrated	-	-
Zap Calendarcom_zcalendar	1	Unrated	-	CVE-2017-20268

Vulnerabilities we found and disclosed

90 write-ups. Every one was reported privately to the developer first.

14 More Joomla 3 Security Fixes, Each Tested on a Real 3.10.12 Site

Joomla 5.4.9 fixed 16 core issues. We backported every one reaching Joomla 3 to the mySites.guru one-click patch tool, each proved on a real 3.10.12 site.

2 Oct 2026

SP Page Builder's Joomla 3 Security Patch Was Incomplete. Version 1.0.3 Fixes It.

JoomShaper's first Joomla 3 security patch for SP Page Builder left the captcha bypass live and the XSS fix incomplete. Version 1.0.3 closes both.

2 Oct 2026

Phoca Cart 6.1.9 stops anyone downloading other customers' paid files

Phoca Cart before 6.1.9 let anonymous visitors download the digital products other customers bought. Only the Joomla 6 line is fixed, and 6.1.8 is affected.

1 Oct 2026

Quix Page Builder 6.3.4 Fixes Guest Access and Editor Code Execution Flaws

Quix Page Builder 6.3.4 stops guests changing Quix settings or reading restricted pages, and editors running code on the server. Update every Joomla site.

30 Sept 2026

AcyMailing Shoots Itself in the Foot With a Vanishing Update Site

AcyMailing adds its Joomla update site from PHP, not its manifest, so Rebuild deletes it and Joomla calls a site on a vulnerable version up to date.

30 Sept 2026

OS CCK 8.3.16 for Joomla Fixes a No-Login PHP Upload and an SQL Injection, but the Updater Still Offers 8.3.14

OS CCK for Joomla before 8.3.16 let anyone upload and run PHP (CVE-2026-102427, CVSS 10.0) and had a no-login SQL injection. The updater won't offer the fix.

30 Sept 2026

JCTables for Joomla: Unauthenticated SQL Injection Fixed in 1.21.1

CVE-2026-76570 lets anyone read and rewrite a Joomla database through the JCTables extension without logging in. Scored 10.0 Critical, fixed in 1.21.1.

30 Sept 2026

Joomla 5.4.9 and 6.1.4 Fix 16 Security Issues, Two Rated High

Joomla 5.4.9 and 6.1.4 fix 16 core security issues, including cache directory deletion, SSRF, an MFA bypass and account creation with registration switched off.

29 Sept 2026

Balbooa Forms 2.4.3.4 Fixes Five Security Issues

Balbooa Forms 2.4.3.4 fixes five CVEs in the Joomla form builder, led by a 9.5 unauthenticated RCE. Every version below 2.4.3.4 is affected. Update now.

29 Sept 2026

Three OrdaSoft Joomla Extensions Have Unauthenticated SQL Injections in Their Sort Order

Real Estate Manager, Vehicle Manager and Book Library for Joomla each have an SQL injection needing no login and a reflected XSS. Six CVEs and their fixes.

28 Sept 2026

Modules Anywhere 10.0.0 and Tabs & Accordions 3.2.0 Close Two Content Author Security Holes

CVE-2026-100750 and CVE-2026-100751: Regular Labs fixed two High severity issues in Modules Anywhere 10.0.0 and Tabs & Accordions 3.2.0 for Joomla.

27 Sept 2026

UP 6.1.0 fixes file read and code execution in the UP plugin for Joomla

Before UP 6.1.0, one anonymous request could read a Joomla site's configuration.php through the UP plugin, and any author could run PHP. We found it.

26 Sept 2026

Every disclosure we have published