Joomla Vulnerability Database

These are the 361 vulnerability rules mySites.guru checks every connected Joomla site against, covering 214 extensions and 432 CVE-numbered vulnerabilities. A good number of them exist because we found the flaw ourselves and reported it to the developer before publishing.

Rules current as of 25 October 2026. Subscribers see which of their own sites are affected, on the site's Manage page.

Why no WordPress CVE or vulnerability data?

WordPress is covered by the service too: mySites.guru integrates Wordfence's vulnerability feed in full, mirroring the data published on Wordfence's vulnerability pages, and every connected WordPress site is checked against it on each audit. To research a WordPress plugin or theme yourself, search Wordfence's database directly.

Subscribe by RSS

New rules as we start checking sites against them. One item per rule, so a CVE needing a rule per Joomla branch appears once for each.

https://mysites.guru/vulnerabilities/rss.xml

Open feed

One item per CVE instead

This page is public. Acting on it across a portfolio is the mySites.guru subscription: each audit checks every connected Joomla and WordPress site against these rules, flags the ones running an affected version, and updates the extension in one click across all of them. One price, unlimited sites, 90,000+ sites protected in 14 years.

Check your sites free Read our disclosures

Extensions we track

Filter by severity, or search for the extension or CVE you're after. Browse every tracked CVE at the Joomla CVE index.

Extension	Rules	Severity	Latest	CVEs
Page Builder CKcom_pagebuilderck	10	Critical, High, Medium	2026-08-17	CVE-2026-74254 CVE-2026-77993 CVE-2026-77994 CVE-2026-63048 CVE-2026-62414 CVE-2026-56290
J2Store / J2Commercecom_j2store	9	Critical, High	2026-09-15	CVE-2026-78081 CVE-2026-81567 CVE-2026-81568 CVE-2026-82189 CVE-2026-82190 CVE-2026-82191 CVE-2026-77999 CVE-2026-78000 CVE-2026-78064 CVE-2026-78065 CVE-2026-78069 CVE-2026-67358 CVE-2026-67359 CVE-2026-67360 CVE-2026-67361 CVE-2026-67362 CVE-2026-74252 CVE-2020-13996
YOOtheme Proyootheme	8	Critical, High, Medium	2026-10-21	CVE-2026-102785 CVE-2026-77997 CVE-2026-76613 CVE-2026-75115
Phoca Cartcom_phocacart	7	Critical, High, Medium	2026-10-01	CVE-2026-102775 CVE-2026-74251 CVE-2026-76564 CVE-2026-76565
miniOrange SAML SSOcom_miniorange_saml	6	Critical, High	2026-08-31	CVE-2026-78074 CVE-2026-77998
Phoca Downloadcom_phocadownload	6	Critical, High, Medium	2026-07-10	CVE-2026-57828 CVE-2026-76569
SP Page Buildercom_sppagebuilder	5	Critical, High, Medium	2026-10-05	CVE-2026-102426 CVE-2026-78375 CVE-2026-79700 CVE-2026-79701 CVE-2026-81564 CVE-2026-81565 CVE-2026-81566 CVE-2026-67285 CVE-2026-67286 CVE-2026-67287 CVE-2026-65876 CVE-2026-65766 CVE-2026-65877 CVE-2026-66494 CVE-2026-65878 CVE-2026-65879 CVE-2026-48908
Gridboxcom_gridbox	4	Critical, High	2026-10-08	CVE-2026-102783 CVE-2026-102784 CVE-2026-61425 CVE-2026-65884 CVE-2026-65885 CVE-2026-65889 CVE-2026-65890 CVE-2026-66488 CVE-2026-66489 CVE-2026-66490 CVE-2026-65886 CVE-2026-65887 CVE-2026-65888 CVE-2026-65947
miniOrange OAuth Clientcom_miniorange_oauth	4	Critical, High	2026-08-31	CVE-2026-78074 CVE-2026-77995
Articles Anywherearticlesanywhere	3	Critical, High	2026-09-13	CVE-2026-85195 CVE-2026-85196 CVE-2026-64793 CVE-2026-64794 CVE-2026-64795 CVE-2026-64799 CVE-2026-65755
Balbooa Formscom_baforms	3	Critical	2026-09-29	CVE-2026-102425 CVE-2026-102424 CVE-2026-101127 CVE-2026-101112 CVE-2026-101126 CVE-2026-67364 CVE-2026-67363 CVE-2026-65880 CVE-2026-56291 CVE-2025-49485
Conditional Contentconditionalcontent	3	Critical, Medium	2026-09-13	CVE-2026-85192 CVE-2026-85188 CVE-2026-63280 CVE-2026-63281 CVE-2026-63683 CVE-2026-64792
Events Bookingcom_eventbooking	3	Critical, Medium	2026-07-20	CVE-2026-63047 CVE-2026-58149 CVE-2026-60024 CVE-2026-60025
Helix Ultimateshaper_helixultimate	3	Critical, High	2026-08-31	CVE-2026-78075 CVE-2026-78076 CVE-2026-78077 CVE-2026-78078 CVE-2026-78079 CVE-2026-57829 CVE-2026-57830
Helix Ultimate Frameworkhelixultimate	3	Critical, High	2026-08-31	CVE-2026-78075 CVE-2026-78076 CVE-2026-78077 CVE-2026-78078 CVE-2026-78079 CVE-2026-57829 CVE-2026-57830
iCagendacom_icagenda	3	Critical	2026-06-15	CVE-2026-48939 CVE-2026-67365 CVE-2026-71571 CVE-2026-67366 CVE-2026-71570
J-BusinessDirectorycom_jbusinessdirectory	3	Critical	2026-08-19	CVE-2026-75949 CVE-2026-75954 CVE-2026-75956 CVE-2026-75950 CVE-2026-75951 CVE-2026-75952 CVE-2026-75953 CVE-2026-75955 CVE-2020-5182 CVE-2019-25752
JCEcom_jce	3	Critical, High, Medium	2026-07-29	CVE-2026-65891 CVE-2026-48907 CVE-2015-7339
Modules Anywheremodulesanywhere	3	Critical, High	2026-09-27	CVE-2026-100750 CVE-2026-65757 CVE-2026-64793 CVE-2026-64795
Sourcerersourcerer	3	Critical, Low	2026-08-17	CVE-2026-74253 CVE-2025-22204 CVE-2026-64796
ZOOcom_zoo	3	Critical, High, Medium	2026-08-21	CVE-2026-76611 CVE-2026-76612 CVE-2026-77028 CVE-2026-77029 CVE-2026-76610 CVE-2026-74803 CVE-2026-74804 CVE-2026-75114
AcyMailingcom_acym	2	Critical	2026-09-24	CVE-2026-94132 CVE-2026-94131 CVE-2026-56292 CVE-2023-39970 CVE-2023-39971 CVE-2023-39972 CVE-2023-39973 CVE-2023-39974
Astroid Frameworkastroid	2	Critical	2026-03-05	CVE-2026-21628
Book Librarycom_booklibrary	2	Critical, Medium	2026-09-28	CVE-2026-101111 CVE-2026-101110
Easy Folder Listing Procom_easyfolderlistingpro	2	Critical	2024-11-26	CVE-2024-11145
Fabrikcom_fabrik	2	Critical, High	2026-08-22	CVE-2026-76571 CVE-2026-76596 CVE-2026-76597 CVE-2026-76598 CVE-2026-76600 CVE-2026-76601 CVE-2026-76602 CVE-2026-76603 CVE-2026-76604 CVE-2026-76605 CVE-2026-76606 CVE-2026-76607 CVE-2026-76608 CVE-2026-76609 CVE-2026-77027 CVE-2026-77992 CVE-2026-76599 CVE-2020-37219 CVE-2026-67282 CVE-2026-66915
jDownloadscom_jdownloads	2	Critical, Medium	2026-07-17	CVE-2026-61900 CVE-2025-55758 CVE-2022-27909
JEventscom_jevents	2	Critical	2025-01-01	CVE-2025-49467 CVE-2015-7340
K2com_k2	2	Critical, Medium	2026-06-25	CVE-2026-48941 CVE-2026-48942 CVE-2026-48943 CVE-2026-48944 CVE-2026-48945 CVE-2026-48946 CVE-2026-48940
OS CCKcom_os_cck	2	Critical	2026-10-05	CVE-2026-102428 CVE-2026-102427
OS Gallerycom_osgallery	2	Critical	2026-09-20	CVE-2026-88854 CVE-2026-88857 CVE-2026-88856 CVE-2026-88855
Real Estate Managercom_realestatemanager	2	Critical, Medium	2026-09-28	CVE-2026-100753 CVE-2026-100752
Smart Slider 3 Prosmartslider3	2	Critical, Medium	2026-04-08	CVE-2026-34424
UP Universal Pluginup	2	Critical	2026-09-26	CVE-2026-97160 CVE-2026-97161 CVE-2026-97162 CVE-2026-97163
Vehicle Managercom_vehiclemanager	2	Critical, Medium	2026-09-28	CVE-2026-101109 CVE-2026-101108
Aimy Captcha-Less Form Guardaimycaptchalessformguard	1	Critical	2026-07-28	CVE-2026-65883
Articles Calendarmod_articles_calendar	1	Critical	2025-07-18	CVE-2025-26855
Articles Calendararticlescalendar	1	Critical	2025-07-18	CVE-2025-26855
BrainCert Virtual Classroomcom_virtualclassroom	1	Critical	2023-08-07	CVE-2023-34477
Conditional Contentpkg_conditionalcontent	1	Critical	2026-09-13	CVE-2026-85192 CVE-2026-85188
Creative Contact Formcom_creativecontactform	1	Critical	2020-03-04	CVE-2014-8739 CVE-2020-9364
DJ-Classifiedscom_djclassifieds	1	Critical	2026-07-20	CVE-2026-61424 CVE-2025-54474
EDocmancom_edocman	1	Critical	2026-07-14	CVE-2026-57832
Helix3 Templateshaper_helix3	1	Critical	2026-06-29	CVE-2026-49049
JCTablescom_jctables	1	Critical	2026-09-30	CVE-2026-76570
JEM - Joomla Event Managercom_jem	1	Critical	2026-08-27	CVE-2026-77034 CVE-2026-77035 CVE-2026-77989 CVE-2026-77990 CVE-2026-77991
JooDatabasecom_joodb	1	Critical	2026-09-03	CVE-2026-78080
JoomCCKcom_joomcck	1	Critical	2026-07-17	CVE-2026-49048
LMS Litecom_lmslite	1	Critical	2023-12-14	CVE-2023-40629
OrdaSoft Simple Membershippkg_simplemembership	1	Critical	2026-10-07	CVE-2026-102782
OrdaSoft Simple Membershipcom_simplemembership	1	Critical	2026-10-07	CVE-2026-102782
Regular Labs GeoIPgeoip	1	Critical	2026-07-23	CVE-2026-65431 CVE-2026-64876 CVE-2026-65430 CVE-2026-64875
RSFiles!com_rsfiles	1	Critical	2026-07-10	CVE-2026-57827 CVE-2025-50057
RSForm!Procom_rsform	1	Critical	2025-01-01	CVE-2025-30085 CVE-2025-27444
SP LMScom_splms	1	Critical	2026-01-01	CVE-2026-48909
SP Property Findercom_spproperty	1	Critical	2026-09-10	CVE-2026-78082 CVE-2026-78303 CVE-2026-78083 CVE-2026-78084 CVE-2026-78302 CVE-2026-78085
Starshopcom_starshop	1	Critical	2023-12-14	CVE-2023-49708
Visitors Countermod_vvisit_counter	1	Critical	2025-10-03	CVE-2025-40636
YouTube Gallerycom_youtubegallery	1	Critical	2026-09-26	CVE-2026-94130
Snippetscom_snippets	9	High, Medium	2026-09-13	CVE-2026-88852 CVE-2026-63684 CVE-2026-64792 CVE-2026-63265
DPCalendarcom_dpcalendar	7	High, Medium	2026-08-28	CVE-2026-78071 CVE-2026-78070 CVE-2026-57831 CVE-2024-21727
Convert Formscom_convertforms	5	High	2026-07-23	CVE-2026-65758 CVE-2024-40744 CVE-2024-40745 CVE-2025-22212 CVE-2026-77026
Tabs & Accordionstabsaccordions	5	High, Medium	2026-09-27	CVE-2026-100751 CVE-2026-85191 CVE-2026-64792 CVE-2026-63265
JCH Optimizecom_jchoptimize	4	High	2026-10-10	-
Visformscom_visforms	4	High	-	CVE-2023-23753
Modalsmodals	3	High	2026-09-13	CVE-2026-85189 CVE-2026-88853 CVE-2026-65713
Quix Page Buildercom_quix	3	High	2026-07-15	CVE-2026-58078 CVE-2026-60026 CVE-2026-60027 CVE-2026-60028 CVE-2026-60029 CVE-2026-60030 CVE-2026-60031
EasyStorecom_easystore	2	High	2026-09-23	CVE-2026-90899 CVE-2026-90900 CVE-2026-90901 CVE-2026-90902 CVE-2026-90903 CVE-2026-90904 CVE-2026-90905 CVE-2026-65759 CVE-2026-65760 CVE-2026-65761
Event Gallerycom_eventgallery	2	High, Medium	2026-10-04	CVE-2026-102776 CVE-2026-102777 CVE-2026-102778 CVE-2026-97164 CVE-2026-97165 CVE-2026-100747 CVE-2026-100748 CVE-2026-100749
JoomGallerycom_joomgallery	2	High, Medium	2026-09-15	CVE-2026-84048 CVE-2026-66917 CVE-2026-66916
miniOrange LDAP Integrationcom_miniorange_dirsync	2	High	2026-08-31	CVE-2026-78074 CVE-2023-23749
Phoca Commandercom_phocacommander	2	High	2026-07-27	CVE-2026-65764 CVE-2026-65765 CVE-2025-54473 CVE-2026-66491 CVE-2026-66492 CVE-2026-66493
Quick Indexquickindex	2	High, Medium	2026-09-13	CVE-2026-85190 CVE-2026-63265
Sexy Polling Reloadedcom_sexypolling	2	High	2026-08-28	CVE-2026-78072
Snippetspkg_snippets	2	High	2026-09-13	CVE-2026-88852
Tabs & Accordionspkg_tabsaccordions	2	High	2026-09-27	CVE-2026-100751 CVE-2026-85191
Users Anywhereusersanywhere	2	High, Medium	2026-09-13	CVE-2026-85196 CVE-2026-64794 CVE-2026-64795 CVE-2026-64799 CVE-2026-65755
YOOtheme Prolocation	2	High	2026-08-25	CVE-2026-77996
4Analyticscom_foranalytics	1	High	2026-07-15	CVE-2026-58077 CVE-2026-57833
AcyMailingcom_acymailing	1	High	2020-03-09	CVE-2015-7338
Admiror Framesadmirorframes	1	High	2024-06-28	CVE-2024-5735 CVE-2024-5736 CVE-2024-5737
Articles Anywherepkg_articlesanywhere	1	High	2026-09-13	CVE-2026-85195 CVE-2026-85196
ChronoForms 8com_chronoforms8	1	High	2026-07-17	CVE-2026-58148
DPAttachmentscom_dpattachments	1	High	2026-09-10	-
DPAttachmentspkg_dpattachments	1	High	2026-09-10	-
DPCasescom_dpcases	1	High	2026-09-10	-
DPCasespkg_dpcases	1	High	2026-09-10	-
DPMedialib_dpmedia	1	High	2026-09-10	-
DPMediapkg_dpmedia	1	High	2026-09-10	-
Dropfilescom_dropfiles	1	High	2026-10-13	-
Easy Shopcom_easyshop	1	High	2019-01-01	CVE-2019-25760
EasyDiscusscom_easydiscuss	1	High	2026-01-16	CVE-2026-21623 CVE-2026-21624 CVE-2026-21625 CVE-2026-21626
Event Registration Pro Calendarcom_registrationpro	1	High	2017-01-01	CVE-2017-20273
Extra Searchcom_extrasearch	1	High	2017-01-01	CVE-2017-20281
Flip Wallcom_flipwall	1	High	2026-06-19	CVE-2017-20265
Gurucom_guru	1	High	-	CVE-2022-23802
HDW Playercom_hdwplayer	1	High	2026-05-13	CVE-2020-37218
Ignite Gallerycom_igallery	1	High	2026-07-07	-
J-ClassifiedsManagercom_displayads	1	High	2019-01-01	CVE-2019-25751
J-MultipleHotelReservationcom_jmultiplehotelreservation	1	High	2019-01-01	CVE-2019-25750
jCartcom_jcart	1	High	2017-01-01	CVE-2017-20282
JHotelReservationcom_jhotelreservation	1	High	2019-01-01	CVE-2019-25748
jNewscom_jnews	1	High	2020-03-09	CVE-2015-7341 CVE-2015-7342 CVE-2015-7343
Jomrescom_jomres	1	High	2026-05-23	CVE-2013-3931 CVE-2013-3932 CVE-2018-25354
JoomCRMcom_joomcrm	1	High	2019-01-01	CVE-2019-25761
Joomdlecom_joomdle	1	High	2026-07-28	CVE-2026-65881 CVE-2026-65882
LMS King Professionalcom_lmsking	1	High	2017-01-01	CVE-2017-20274
miniOrange Custom APIcom_miniorange_customapi	1	High	2026-08-31	CVE-2026-78074
miniOrange Import Export Userscom_miniorange_importexportusers	1	High	2026-08-31	CVE-2026-78074
miniOrange Keycloak User Synccom_miniorange_keycloaksync	1	High	2026-08-31	CVE-2026-78074
miniOrange Restrict Files / Folderscom_miniorange_mediarestriction	1	High	2026-08-31	CVE-2026-78074
miniOrange SCIM User Provisioningcom_miniorange_scim	1	High	2026-08-31	CVE-2026-78074
miniOrange Two Factor Authenticationcom_miniorange_twofa	1	High	2026-08-31	CVE-2026-78074
Modalspkg_modals	1	High	2026-09-13	CVE-2026-85189 CVE-2026-88853
Modules Anywherepkg_modulesanywhere	1	High	2026-09-27	CVE-2026-100750
MyPortfoliocom_myportfolio	1	High	2017-01-01	CVE-2017-20280
OS Propertycom_osproperty	1	High	2026-08-09	-
paGO Commercecom_pago	1	High	2020-09-18	CVE-2020-25751
Phoca Gallerycom_phocagallery	1	High	2026-10-23	CVE-2026-102786
PHP-Bridgecom_phpbridge	1	High	2017-01-01	CVE-2017-20275
Quantum Managercom_quantummanager	1	High	2025-08-25	CVE-2025-54300 CVE-2025-54301
Quick Indexpkg_quickindex	1	High	2026-09-13	CVE-2026-85190
Regular Labs DB Replacercom_dbreplacer	1	High	2026-07-22	CVE-2026-63685 CVE-2026-63265
Regular Labs Extension Managercom_regularlabsmanager	1	High	2026-07-22	CVE-2026-64791 CVE-2026-63265
Regular Labs IP Loginiplogin	1	High	2026-07-22	CVE-2026-64797 CVE-2026-64798 CVE-2026-63265
RO CSVIcom_csvi	1	High	2026-07-28	CVE-2026-65943 CVE-2026-65944 CVE-2026-65946
S5 Registermod_s5_register	1	High	2023-12-14	CVE-2023-49707
StreetGuessr Gamecom_streetguess	1	High	2017-01-01	CVE-2017-20271
Survey Force Deluxecom_surveyforce	1	High	2026-06-19	CVE-2017-20256
T4 Page Buildercom_t4pagebuilder	1	High	2026-08-28	CVE-2026-78374
Twitch TVcom_twitchtv	1	High	2017-01-01	CVE-2017-20270
Ultimate Property Listingcom_upl	1	High	2017-01-01	CVE-2017-20272
vAccountcom_vaccount	1	High	2019-01-01	CVE-2019-25756
vBizzcom_vbizz	1	High	2019-01-01	CVE-2019-25758 CVE-2019-25759
VMapcom_vmap	1	High	2019-01-01	CVE-2019-25753
vReviewcom_vreview	1	High	2019-01-01	CVE-2019-25755
vWishlistcom_vwishlist	1	High	2019-01-01	CVE-2019-25757
Content Templatercom_contenttemplater	5	Medium	2026-09-13	CVE-2026-85188 CVE-2026-63684 CVE-2026-63280 CVE-2026-63281 CVE-2026-63683
Advanced Module Manageradvancedmodules	4	Medium	2026-09-13	CVE-2026-85188 CVE-2026-63280 CVE-2026-63281 CVE-2026-63683 CVE-2026-63265
ReReplacercom_rereplacer	4	Medium	2026-09-13	CVE-2026-85188 CVE-2026-65754 CVE-2026-63684 CVE-2026-63280 CVE-2026-63281
JoomShoppingcom_jshopping	2	Medium, Low	2026-07-22	CVE-2026-63264 CVE-2025-22211
Phoca Mapscom_phocamaps	2	Medium	2026-07-23	CVE-2026-65763 CVE-2026-23900
Advanced Module Managerpkg_advancedmodules	1	Medium	2026-09-13	CVE-2026-85188
All Video Sharecom_allvideoshare	1	Medium	2026-08-28	CVE-2026-78073
Balbooa Gallerycom_bagallery	1	Medium	2025-07-18	CVE-2025-49486 CVE-2023-23757
Balbooa Gallerycom_gallery	1	Medium	2026-08-18	-
Booking - Book Itcom_booking	1	Medium	2023-01-01	CVE-2023-54357
CCommentcom_comment	1	Medium	2025-07-23	CVE-2025-54297
Clicky Analytics Dashboardmod_clicky_dash	1	Medium	2023-12-14	CVE-2023-40658
Content Templaterpkg_contenttemplater	1	Medium	2026-09-13	CVE-2026-85188
DJ-HelpfulArticlescom_djhelpfularticles	1	Medium	2024-07-09	CVE-2024-27183
Easy Quick Contactmod_easyquickcontact	1	Medium	2023-12-14	CVE-2023-40659
iProperty Real Estatecom_iproperty	1	Medium	2026-04-09	CVE-2023-54361
JLex Reviewcom_jlexreview	1	Medium	2026-04-09	CVE-2023-54360
Joomill Admin Checklistcom_checklist	1	Medium	2026-10-07	-
Joomill Admin Checklistmod_checklist_categories	1	Medium	2026-10-07	-
JoomProjectcom_jpprojects	1	Medium	2019-01-01	CVE-2019-25762
JS Jobscom_jsjobs	1	Medium	2026-06-04	CVE-2019-25740 CVE-2018-25327 CVE-2025-22206 CVE-2025-22208 CVE-2025-22209 CVE-2025-49484 CVE-2025-54475
LivingWordcom_livingword	1	Medium	2023-12-14	CVE-2023-40627
Membership Procom_osmembership	1	Medium	2026-07-21	CVE-2026-62415
oneVotecom_onevote	1	Medium	2023-07-11	CVE-2023-23756
OrdaSoft Touch Slidermod_os_touchslider	1	Medium	2026-10-07	CVE-2026-102781
OrdaSoft Touch Sliderpkg_ostouchslider	1	Medium	2026-10-07	CVE-2026-102781
osTicky2com_osticky2	1	Medium	2024-02-15	CVE-2024-21728
Phoca Guestbookcom_phocaguestbook	1	Medium	2026-07-23	CVE-2026-65762
Regular Labs Better Frontend Linkmod_betterfrontendlink	1	Medium	2026-07-22	CVE-2026-63265
Regular Labs CDNcdnforjoomla	1	Medium	2026-07-22	CVE-2026-65712 CVE-2026-63265
Regular Labs Email Protectoremailprotector	1	Medium	2026-07-22	CVE-2026-63265
ReReplacerpkg_rereplacer	1	Medium	2026-09-13	CVE-2026-85188
RSBlog!com_rsblog	1	Medium	2025-01-01	CVE-2025-50126 CVE-2025-27754
Solidrescom_solidres	1	Medium	2026-04-09	CVE-2023-54363
TF Contentcom_tfcontent	1	Medium	2026-10-05	CVE-2026-102779 CVE-2026-102780
Users Anywherepkg_usersanywhere	1	Medium	2026-09-13	CVE-2026-85196
VirtueMartcom_virtuemart	1	Medium	2026-04-09	CVE-2023-54362 CVE-2025-25228 CVE-2025-55757
XCloner Backupcom_xcloner-backupandrestore	1	Medium	2020-05-23	CVE-2020-13424
HikaShopcom_hikashop	1	Low	2026-07-20	CVE-2026-61901 CVE-2023-38044 CVE-2024-40746 CVE-2025-22210 CVE-2025-25225 CVE-2015-7344
SEBLODcom_cck	3	Unrated	-	CVE-2026-66914
Cache Cleanercachecleaner	2	Unrated	-	CVE-2026-64871 CVE-2026-64872 CVE-2026-64873 CVE-2026-64874
Cotton Cloudcom_cotton	2	Unrated	-	CVE-2026-67283 CVE-2026-67284
Admiror Gallerycom_admirorgallery	1	Unrated	-	CVE-2025-22205 CVE-2023-38045
Ajax Quizcom_ajaxquiz	1	Unrated	-	CVE-2017-20262
Cache Cleanerpkg_cachecleaner	1	Unrated	-	CVE-2026-64871 CVE-2026-64872 CVE-2026-64873 CVE-2026-64874
CommentBoxcom_commentbox	1	Unrated	-	CVE-2025-54298
Creative Gallerycom_creativegallery	1	Unrated	-	CVE-2023-23758
DJ-Flyercom_djflyer	1	Unrated	-	CVE-2025-50127
DJ-Reviewscom_djreviews	1	Unrated	-	CVE-2025-54295
DOCmancom_docman	1	Unrated	-	CVE-2022-27910
eXtplorercom_extplorer	1	Unrated	-	CVE-2023-40628
FocalPointcom_focalpoint	1	Unrated	-	CVE-2017-20263
iCagenda Calendar modulemod_icagenda_calendar	1	Unrated	-	CVE-2026-67365
JCDashboardscom_jcdashboards	1	Unrated	-	CVE-2023-40630
JMediacom_jmedia	1	Unrated	-	CVE-2026-60032 CVE-2026-60033 CVE-2026-60034
JoomDOCcom_joomdoc	1	Unrated	-	CVE-2023-40657
Joomla Quiz Deluxecom_joomlaquiz	1	Unrated	-	CVE-2017-20257
JoomRecipecom_joomrecipe	1	Unrated	-	CVE-2017-20277 CVE-2017-20278
Keyboard Shortcutskeyboardshortcuts	1	Unrated	-	CVE-2026-65756
Komentocom_komento	1	Unrated	-	CVE-2025-54294
No Boss Calendarcom_nobosscalendar	1	Unrated	-	CVE-2025-49468
No Boss Testimonialscom_nobosstestimonials	1	Unrated	-	CVE-2025-54299
OSDownloadscom_osdownloads	1	Unrated	-	CVE-2017-20259
Payagecom_payage	1	Unrated	-	CVE-2017-20279
ProFilescom_profiles	1	Unrated	-	CVE-2025-54296
Proforms Basiccom_proforms	1	Unrated	-	CVE-2023-34476 CVE-2023-40655
QuickFormcom_quickform	1	Unrated	-	CVE-2023-40656
RSDirectory!com_rsdirectory	1	Unrated	-	CVE-2025-50058
RSFirewall!com_rsfirewall	1	Unrated	-	CVE-2025-27445
RSMail!com_rsmail	1	Unrated	-	CVE-2025-50056 CVE-2025-30084
RSMediaGallery!com_rsmediagallery	1	Unrated	-	CVE-2025-27753 CVE-2025-32466
RSTickets! Procom_rsticketspro	1	Unrated	-	CVE-2025-32465
SIMGenealogycom_simgenealogy	1	Unrated	-	CVE-2017-20276
SP Movie Databasecom_spmoviedb	1	Unrated	-	CVE-2017-20266
Sponsor Wallcom_sponsorwall	1	Unrated	-	CVE-2017-20264
Tooltipstooltips	1	Unrated	-	-
Zap Calendarcom_zcalendar	1	Unrated	-	CVE-2017-20268

Vulnerabilities we found and disclosed

100 write-ups. Every one was reported privately to the developer first.

Phoca Gallery 6.1.6 fixes a stored XSS hidden in a photo's EXIF data

Phoca Gallery 4.5.0 to 6.1.5 lets a crafted image's EXIF data run script on the photo info view. 6.1.6 fixes it on Joomla 6 only; Joomla 4 and 5 are stranded.

23 Oct 2026

The PHP Project Advises Turning Off Session Upload Progress Until the Next Release

PHP has posted an informational advisory on session upload progress and CVE-2026-115560. Who needs to act, the one-line fix, and how to find sites with it on.

23 Oct 2026

YOOtheme Pro 5.0.53 Fixes an Unauthenticated RCE: Update Every Site Now

YOOtheme Pro 5.0.53 fixes CVE-2026-102785, an unauthenticated remote code execution flaw in the image handler. Update every Pro 5 site now; Pro 4 is unaffected.

21 Oct 2026

The Joomla Content Editor (JCE) Hack, Four Months On

Four months after the JCE hack hit Joomla sites, unpatched installs are still being compromised. See the damage and how mySites.guru finds and fixes it.

20 Oct 2026

YOOtheme Pro 5: A Critical Security Update Is Coming on 21 October

YOOtheme has given advance notice of a critical security update for YOOtheme Pro 5, due 21 October at 16:00 CEST. Every Pro 5 site must update; Pro 4 is safe.

20 Oct 2026

What is Joomla 3.x UTD (And why you don't need it)

Joomla 3.x UTD is a one-developer fork of Joomla 3 sold as secure. It has unsigned updates, its own security bugs and no way back to Joomla.

12 Oct 2026

Gridbox 2.20.4.0 Fixes a Language Install CSRF and an Image Path Check

Gridbox 2.20.4.0 fixes a CSRF flaw in language installation and tightens image preview path checks. Every Joomla site on 2.20.3.1 or older should update.

8 Oct 2026

JCH Optimize 9.4.0 Fixes Six High-Rated Security Issues in the Joomla Extension

JCH Optimize 9.4.0 fixed an XSS, an unauthenticated hit counter flaw and missing admin CSRF checks; 9.4.2 fixes a file read and an SSRF. Update to 9.4.2.

7 Oct 2026

OrdaSoft Simple Membership and Touch Slider for Joomla: Two Flaws That Need No Login

Simple Membership for Joomla has an SQL injection in its login check, CVSS 9.3, and Touch Slider lets anyone delete or replace its slides. Versions and fixes.

7 Oct 2026

Event Gallery 6.6.0 Fixes Forged Backend Changes and a Google Photos Token Leak

Event Gallery 6.6.0 fixes a backend CSRF, a Google Photos token leak and an XSS (CVE-2026-102776 to 102778). Every Joomla site below 6.6.0 needs it.

4 Oct 2026

14 More Joomla 3 Security Fixes, Each Tested on a Real 3.10.12 Site

Joomla 5.4.9 fixed 16 core issues. We backported every one reaching Joomla 3 to the mySites.guru one-click patch tool, each proved on a real 3.10.12 site.

2 Oct 2026

SP Page Builder's Joomla 3 Security Patch Was Incomplete. Version 1.0.3 Fixes It.

JoomShaper's first Joomla 3 security patch for SP Page Builder left the captcha bypass live and the XSS fix incomplete. Version 1.0.3 closes both.

2 Oct 2026

Every disclosure we have published