Security
Tassos Joomla extensions fix two security flaws
Tassos has released security updates for Advanced Custom Fields and Smile Pack for Joomla, fixing a high-severity stored XSS issue and a medium-severity image deletion flaw.
Research published by mySites.guru identifies two vulnerabilities in the shared Tassos framework used by both extensions. CVE-2026-115452 is stored cross-site scripting in Map marker labels, rated CVSS 7.5 High. CVE-2026-115451 is an improper access control flaw allowing unauthenticated deletion of Gallery images, rated 6.9 Medium. The write-up reports no exploitation of either issue.
- Advanced Custom Fields: the Map flaw affects
3.0.0–3.1.8and2.8.2–2.8.15; the Gallery flaw affects3.1.4–3.1.8and2.8.13–2.8.15. Update to3.1.9on Joomla 4 and later, or2.8.16on Joomla 3. - Smile Pack: the Map flaw affects
2.0.0–2.1.6and1.1.2–1.2.9; the Gallery flaw affects2.1.2–2.1.6and1.2.7–1.2.9. Update to2.1.7or1.2.10for Joomla 3.
Administrators should apply the matching update promptly and review older installations as potentially affected.
Originally reported by mySites.guru.