Extensions

CMSPatrol Integrity watches Joomla files for unexpected changes

CMSPatrol Integrity compares a Joomla site's files with a trusted baseline to flag additions, changes and deletions.

27 Oct 2026

Extensions

KCanonicalUrl adds sitewide canonical links to Joomla pages

KCanonicalUrl is a free Joomla plugin for declaring which URL search engines should treat as the canonical version of each frontend page.

27 Oct 2026

Extensions

KSelfHostFonts moves Google Fonts off third-party servers

External font requests are a small but recurring privacy and hosting decision for Joomla site owners.

27 Oct 2026

Security

iCagenda security update fixes stored XSS and CSV injection

JoomliC has issued security releases for the Joomla extension iCagenda, fixing stored cross-site scripting and CSV formula injection vulnerabilities.

27 Oct 2026

Security

Quix 6.4.0 fixes unauthorised article access

ThemeXpert’s Quix Page Builder 6.4.0 fixes an access-control flaw that allowed unauthenticated visitors to retrieve restricted Joomla article content.

27 Oct 2026

Security

Gridbox 2.20.4.2 fixes two critical SQL flaws

Balbooa has released Gridbox 2.20.4.2 to address two critical vulnerabilities that could be exploited without a Joomla login.

27 Oct 2026

Security

DJ-HelpfulArticles 1.3 fixes stored XSS flaw

DJ-Extensions has fixed a High-severity stored cross-site scripting flaw in its Joomla article-rating extension, DJ-HelpfulArticles, with version 1.3.

27 Oct 2026

Security

Vik extensions receive fixes for CSRF and stored XSS

E4J has released security updates for three Joomla extensions, addressing a CSRF weakness and stored cross-site scripting in Vik Booking, Vik Rent…

26 Oct 2026

Security

Phoca Download fixes CSRF flaw only on Joomla 6 line

Phoca Download 6.1.6 fixes a low-severity CSRF vulnerability affecting front-end file actions, but the patch is limited to the Joomla 6 release line.

26 Oct 2026

Security

StageIt updates fix CSRF and PHP injection risks

Joomla staging extension StageIt has received security updates addressing CSRF flaws and a settings-file issue that could enable PHP execution.

26 Oct 2026

Security

Phoca Gallery flaw exposes Joomla sites to stored XSS

Phoca Gallery versions 4.5.0 through 6.1.5 contain a stored cross-site scripting flaw that can execute code from crafted image EXIF data when a…

23 Oct 2026

Security

PHP advises disabling session upload progress

PHP has advised administrators to disable session upload progress as a precaution against CVE-2026-115560, an unlikely remote-code-execution vector…

23 Oct 2026