Joomla Vulnerable Extension Database

The most comprehensive and most up-to-date database of vulnerable Joomla extensions there is: 424 rules covering 239 components, plugins, modules, templates and template frameworks, and 474 CVE-numbered vulnerabilities.

It is also the most actively researched. 324 of those rules cover flaws published in 2026, and a good number exist because we found the flaw ourselves and reported it to the developer before publishing. It is actively maintained too: new rules arrive every few days, and each one starts checking every connected Joomla site within the hour.

Subscribers see which of their own sites are affected, on the site's Manage page.

Why no WordPress CVE or vulnerability data?

WordPress is covered by the service too: mySites.guru integrates Wordfence's vulnerability feed in full, mirroring the data published on Wordfence's vulnerability pages, and every connected WordPress site is checked against it on each audit. To research a WordPress plugin or theme yourself, search Wordfence's database directly.

This page is public. Acting on it across a portfolio is the mySites.guru subscription: each audit checks every connected Joomla and WordPress site against these rules, flags the ones running an affected version, and updates the extension in one click across all of them. One price, unlimited sites, 90,000+ sites protected in 14 years.