Live This site runs Joomla 6.1.2
JoomClub

News, security and craft for the Joomla ecosystem

Security

Joomla extensions hit by SQL injection and stored XSS flaws

Two Joomla extensions have received security fixes for high-severity, unauthenticated vulnerabilities: SQL injection in JoomCCK and stored cross-site scripting in ChronoForms.

1 min read

The Joomla CNA published the disclosures, which were covered by mySites.guru. Neither issue is reported as being actively exploited.

  • CVE-2026-49048 affects JoomCCK from JoomCoder through version 6.4.0. The unauthenticated SQL injection can be reached without logging in and may allow database reads. It is fixed in 6.4.1. The CNA assigned a CVSS 4.0 score of 8.7 (High); the CVSS 3.1 score is 9.8 (Critical). The issue was reported by Kamil Soltanov.
  • CVE-2026-58148 affects ChronoForms from ChronoEngine through version 8.0.52. The unauthenticated stored XSS allows injected markup to execute in another user’s browser. It is fixed in 8.0.53 and has a CVSS 4.0 score of 8.7 (High). It was reported by Italo Almeida.

Joomla administrators should check whether either extension is installed and update to the fixed version immediately. These are third-party extension flaws, not Joomla core vulnerabilities.

Originally reported by mySites.guru.