Security
Joomill Autolanguage 2.7.2 fixes three security flaws
Joomill has released Autolanguage 2.7.2 for Joomla, fixing three security issues including a medium-severity stored XSS vulnerability in translated content.
The affected extension is Joomill Autolanguage, available in free and PRO editions. Versions below 2.7.2 are affected by the stored cross-site scripting flaw and the batch-translation permissions issue; the report confirms the XSS in free releases as far back as 2.0.0. The Gemini API-key exposure affects PRO only. Joomla core is not affected.
mySites.guru published the research and rated the stored XSS medium severity at 5.1 and the batch-translation issue medium severity at 5.3. The third issue, rated low and unscored, sent PRO Gemini keys in request URLs where infrastructure logs might capture them. No CVE identifiers have been assigned to any of the issues, and mySites.guru did not report active exploitation.
Administrators should update both free and PRO installations to 2.7.2. They should also review existing translations for unexpected script markup, check relevant Joomla text-filter settings and permissions, and rotate PRO Gemini keys where URL logging may have exposed them.
Originally reported by mySites.guru.