Is my site affected?
Your site is affected if it runs Convert Forms in any of these ranges:
- from 5.2.3 up to but not including 5.2.5
- from 5.0.0 up to and including 5.2.2
- from 4.4.16 up to but not including 4.4.17
- from 4.4.10 up to but not including 4.4.16
- before 4.4.10
- Latest safe version
- 5.2.5 or later. No rule we check matches that release or any newer one.
- What to do
- Update Convert Forms to 5.2.5 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.
Convert Forms (com_convertforms) 4.4.10 to 4.4.15 (Joomla 3 branch) - Unauthenticated Submission Disclosure
Tracked as CVE-2026-65758 (Joomla CNA, published 23 July 2026, CVSS 4.0 8.2 High, CWE-200/CWE-284). Convert Forms by Tassos did not enforce access control on the front-end Submissions view, so an unauthenticated visitor could list the submissions sent through a form - exposing whatever that form collects, typically names, email addresses and message bodies. Tassos fixed the flaw separately on each release branch. This rule covers the Joomla 3 branch: 4.4.11 through 4.4.16 are Joomla 3.8/3.9/3.10 only builds, and the fix shipped in 4.4.16 on 27 July 2026. Update to Convert Forms 4.4.16. The floor is 4.4.10 because everything below it is flagged by the separate Convert Forms rule. Sites on Joomla 4, 5 or 6 run the 5.x branch instead, where the same flaw was fixed in 5.2.3 - see the companion rule.
Affected versions: ≥ 4.4.10 and < 4.4.16
Full advisory: www.tassos.gr
Convert Forms (com_convertforms) below 4.4.10 - Unauthenticated Arbitrary File Upload (RCE), Reflected XSS and Authenticated SQL Injection
Convert Forms by Tassos Marinos. CVE-2024-40744 (unauthenticated arbitrary file upload leading to RCE, fixed in 4.4.8), CVE-2024-40745 (reflected XSS, fixed in 4.4.8) and CVE-2025-22212 (authenticated SQL injection in the submission management area, affects 1.0.0-4.4.9). Update to 4.4.10 or later (current line is 5.x).
Affected versions: < 4.4.10
Full advisory: nvd.nist.gov
Convert Forms (com_convertforms) 5.0.0 to 5.2.2 (Joomla 4/5/6 branch) - Unauthenticated Submission Disclosure
Tracked as CVE-2026-65758 (Joomla CNA, published 23 July 2026, CVSS 4.0 8.2 High, CWE-200/CWE-284). Convert Forms by Tassos did not enforce access control on the front-end Submissions view, so an unauthenticated visitor could list the submissions sent through a form - exposing whatever that form collects, typically names, email addresses and message bodies. Tassos fixed the flaw separately on each release branch. This rule covers the 5.x branch, which targets Joomla 4, 5 and 6. The fix shipped in 5.2.3 on 22 July 2026; update to 5.2.4 or later, because 5.2.3 carries the fix but introduced a fatal error in the File Upload field that 5.2.4 corrects. Sites on Joomla 3 run the 4.4.x branch instead, where the same flaw was fixed in 4.4.16 - see the companion rule.
Affected versions: ≥ 5.0.0 and ≤ 5.2.2
Full advisory: www.tassos.gr
Convert Forms (com_convertforms) 5.2.3 to 5.2.4 (Joomla 4/5/6 branch) - Unauthenticated Client-Controlled Validation Bypass (CAPTCHA and field validation bypass, CVE-2026-77026)
Convert Forms 5.2.3 and 5.2.4 on the Joomla 4/5/6 branch let an unauthenticated visitor bypass CAPTCHA and other field validations by claiming the fields were hidden by Conditional Logic. Because the form decides which validation rules apply on the client side, a crafted submission can assert that a required or CAPTCHA-protected field was conditionally hidden and skip its validation entirely. The practical impact is spam and unvalidated data reaching your forms, your notification emails and any downstream integrations. It does not expose existing submissions. Tassos Marinos fixed it in Convert Forms 5.2.5, released 20 August 2026. Update to 5.2.5 or later. Sites on the Joomla 3 branch need 4.4.17 instead, which carries the same fix. CVE-2026-77026, CVSS 4.0 base 6.9 Medium (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L), credited to Murrez. Note: the published CVE description text actually describes an earlier and different flaw, unauthorised front-end viewing of form submissions, which was fixed back in 5.2.3 and is covered by a separate rule. The CVE title, its affected version range and its CVSS vector all match this validation bypass rather than that disclosure.
Affected versions: ≥ 5.2.3 and < 5.2.5
Full advisory: www.tassos.gr
Convert Forms (com_convertforms) 4.4.16 (Joomla 3 branch) - Unauthenticated Client-Controlled Validation Bypass (CAPTCHA and field validation bypass, CVE-2026-77026)
Convert Forms 4.4.16 on the Joomla 3 branch lets an unauthenticated visitor bypass CAPTCHA and other field validations by claiming the fields were hidden by Conditional Logic. Because the form decides which validation rules apply on the client side, a crafted submission can assert that a required or CAPTCHA-protected field was conditionally hidden and skip its validation entirely. The practical impact is spam and unvalidated data reaching your forms, your notification emails and any downstream integrations. It does not expose existing submissions. Tassos Marinos backported the fix to the Joomla 3 branch in Convert Forms 4.4.17, released 21 August 2026, one day after the 5.2.5 release on the Joomla 4/5/6 branch. Update to 4.4.17. CVE-2026-77026, CVSS 4.0 base 6.9 Medium (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L), credited to Murrez. Note: the published CVE description text actually describes an earlier and different flaw, unauthorised front-end viewing of form submissions, which was fixed on this branch in 4.4.16 and is covered by a separate rule. The CVE title, its affected version range and its CVSS vector all match this validation bypass rather than that disclosure.
Affected versions: ≥ 4.4.16 and < 4.4.17
Full advisory: www.tassos.gr
Each CVE page above links its official cve.org record and its NVD entry.