Skip to main content
mySites.guru
Free Audit
NewAdd every Joomla and WordPress site on a WHM or cPanel server in one goSee how it works

Joomill Autolanguage security vulnerabilities

mySites.guru tracks 1 vulnerability in Joomill Autolanguage (autolanguage). Every connected Joomla site is checked against it on each audit.

Is my site affected?

Your site is affected if it runs Joomill Autolanguage in this range:

  • before 2.7.2
Latest safe version
2.7.2 or later. No rule we check matches that release or any newer one.
What to do
Update Joomill Autolanguage to 2.7.2 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Check whether your sites are affected

Every Joomill Autolanguage vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
No CVE idbefore 2.7.22.7.2Medium2026-11-13

What we check for

Medium2026-11-13

Joomill Autolanguage (plg_system_autolanguage) below 2.7.2 - Authenticated Stored XSS and Missing Authorisation

Joomill Autolanguage (free and PRO) before 2.7.2 decoded every HTML entity in a translated result, so text a source item showed as code (for example <script>) became a live script tag in every automatic translation, written past Joomla's text filters. A logged-in user without unfiltered HTML, such as an Author, could use this to plant stored XSS that runs for administrators and visitors viewing the translated item. Batch translation also checked only component rights, letting a backend user limited per category, or allowed to create but not edit, overwrite existing translations. PRO also sent the Gemini API key in the request URL, where proxies log it. No CVE assigned. Update to 2.7.2 or later; until then, review translated items for unexpected script and limit who can create content.

Affected versions: < 2.7.2

Full advisory: our disclosure post

Timeline

  1. 13 November 2026Check added for a flaw with no CVE id (before 2.7.2)
  2. 13 November 2026We published: Joomill Autolanguage 2.7.2 Fixes a Stored XSS Created by Translating an Article

What we have written about Joomill Autolanguage

Joomill Autolanguage 2.7.2 Fixes a Stored XSS Created by Translating an Article

Joomill Autolanguage 2.7.2 Fixes a Stored XSS Created by Translating an Article

Joomill Autolanguage 2.7.2 fixes three security issues in the Joomla extension, led by a stored XSS that translation wrote past Joomla's text filters.

References

Joomill Autolanguage vulnerability questions

Which versions of Joomill Autolanguage are vulnerable?
mySites.guru tracks one vulnerability in Joomill Autolanguage (autolanguage). A site is affected if its installed version is in this range: before 2.7.2.
What is the latest safe version of Joomill Autolanguage?
2.7.2. Every vulnerability tracked here is fixed by 2.7.2, and no rule we check matches that release or any later one.
How do I check which version of Joomill Autolanguage my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for autolanguage. mySites.guru reads the installed version on every audit of a connected site and checks it against this rule.

Running Joomill Autolanguage on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

Rules current as of 13 November 2026.