Joomla vulnerabilities and fixes

CVEs that mention Joomla, ranked by priority. 133 tracked.

Joomla has 133 tracked vulnerabilities, 41 critical. A fixed release or vendor patch exists for 114. Most recent: 2026-10-23. Highest priority: CVE-2026-65761 (score 57/100).

• CVE-2026-65761 CRITICAL 9.3 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improp
• CVE-2026-65880 CRITICAL 10.0 Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An insecure
• CVE-2026-66915 CRITICAL 10.0 Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could
• CVE-2026-67282 CRITICAL 10.0 Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unauthenticated
• CVE-2026-102785 CRITICAL 10.0 Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOthem
• CVE-2026-65883 CRITICAL 9.8 UPGRADE Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 2
• CVE-2026-66914 CRITICAL 9.2 Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 - An unaut
• CVE-2026-76604 CRITICAL 10.0 Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2
• CVE-2026-76605 CRITICAL 10.0 Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2.
• CVE-2026-56292 HIGH 7.5 UPGRADE Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in
• CVE-2026-60024 CRITICAL 9.8 Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 - The Joomla exten
• CVE-2026-65431 CRITICAL 9.8 Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been br
• CVE-2026-64796 CRITICAL 9.8 Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not requ
• CVE-2026-64874 CRITICAL 9.8 Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were
• CVE-2026-65879 CRITICAL 9.8 Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page
• CVE-2026-65884 CRITICAL 9.8 UPGRADE Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows use
• CVE-2026-65887 CRITICAL 9.8 UPGRADE Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassw
• CVE-2026-65888 CRITICAL 9.8 UPGRADE Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method a
• CVE-2026-76606 CRITICAL 10.0 Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.
• CVE-2026-61424 CRITICAL 10.0 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2 - The
• CVE-2026-64873 CRITICAL 9.8 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access inte
• CVE-2026-73373 CRITICAL 9.8 UPGRADE Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The defau
• CVE-2026-76607 CRITICAL 10.0 Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2.
• CVE-2026-77995 CRITICAL 10.0 Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Singl
• CVE-2026-65890 CRITICAL 9.8 UPGRADE Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors all
• CVE-2026-62415 CRITICAL 9.1 Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2 - The Joomla exten
• CVE-2026-64793 CRITICAL 9.1 Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules An
• CVE-2026-64798 CRITICAL 9.1 Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys
• CVE-2026-74253 CRITICAL 10.0 Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer
• CVE-2026-76571 CRITICAL 9.3 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik <
• CVE-2026-62414 CRITICAL 9.1 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Pag
• CVE-2026-67285 CRITICAL 9.2 Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.
• CVE-2026-74254 CRITICAL 9.3 Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder
• CVE-2026-76602 CRITICAL 9.3 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order para
• CVE-2026-77992 CRITICAL 9.5 Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUp
• CVE-2026-77994 CRITICAL 9.3 Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension
• CVE-2026-60027 HIGH 8.7 Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1 -
• CVE-2026-65760 CRITICAL 9.2 Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store ext
• CVE-2026-65766 CRITICAL 9.2 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper valid
• CVE-2026-65759 HIGH 8.7 Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1
• CVE-2026-65876 CRITICAL 9.2 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper valid
• CVE-2026-76597 HIGH 8.7 Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in F
• CVE-2026-76598 HIGH 8.7 Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik
• CVE-2026-57832 HIGH 8.7 Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9 - The Joomla extens
• CVE-2026-76596 HIGH 8.7 Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The lis
• CVE-2026-76599 HIGH 8.7 Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik <
• CVE-2026-65886 HIGH 7.5 UPGRADE Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer al
• CVE-2026-67363 HIGH 7.7 Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeChar
• CVE-2026-58078 HIGH 8.7 Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1 - The Jooml
• CVE-2026-60026 HIGH 8.9 Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1 - The Joomla
• CVE-2026-60034 CRITICAL 9.4 Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - The Joomla extensio
• CVE-2026-65754 HIGH 7.5 Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML inclu
• CVE-2026-65885 HIGH 8.8 UPGRADE Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods
• CVE-2026-60032 CRITICAL 9.4 Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 - The Joomla extensi
• CVE-2026-63048 CRITICAL 9.4 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3
• CVE-2026-66494 HIGH 8.7 Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0
• CVE-2026-66917 HIGH 8.6 Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged c
• CVE-2026-71573 HIGH 8.3 UPGRADE Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper i
• CVE-2026-73337 HIGH 7.5 UPGRADE Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient sta
• CVE-2026-102786 HIGH 8.6 Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Ph
• CVE-2026-63685 HIGH 8.8 Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and
• CVE-2026-64792 HIGH 7.5 Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs
• CVE-2026-64799 HIGH 7.5 Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere e
• CVE-2026-65430 HIGH 7.5 Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where
• CVE-2026-65755 HIGH 7.5 Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywher
• CVE-2026-65881 HIGH 7.5 Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomd
• CVE-2026-65889 HIGH 7.5 UPGRADE Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp me
• CVE-2026-76611 MEDIUM 6.9 Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo <
• CVE-2026-57833 HIGH 8.6 Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joomla extension 4Analy
• CVE-2026-63683 HIGH 7.5 Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP
• CVE-2026-65758 HIGH 8.2 Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end
• CVE-2026-65878 HIGH 8.3 Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper p
• CVE-2026-65943 HIGH 7.5 UPGRADE Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0
• CVE-2026-66491 HIGH 8.2 Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of path
• CVE-2026-76612 HIGH 8.6 Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User
• CVE-2026-77027 HIGH 8.6 Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 - The handling of user supplied
• CVE-2026-60031 MEDIUM 6.9 Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1 - The Joomla extension
• CVE-2026-64797 HIGH 7.5 Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwar
• CVE-2026-66916 MEDIUM 6.9 Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery
• CVE-2026-67283 MEDIUM 6.9 Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.2 -
• CVE-2026-67286 MEDIUM 6.3 Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Bui
• CVE-2026-76600 MEDIUM 6.9 Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteCommen
• CVE-2026-76601 MEDIUM 6.9 Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not
• CVE-2026-76603 MEDIUM 6.9 Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 - The i
• CVE-2026-76608 MEDIUM 6.9 Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.
• CVE-2026-76609 MEDIUM 6.9 Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdate
• CVE-2026-65877 HIGH 8.2 Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validat
• CVE-2026-67287 MEDIUM 6.3 Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthent
• CVE-2026-64875 MEDIUM 6.5 Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoo
• CVE-2026-64872 MEDIUM 6.5 Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log path
• CVE-2026-65713 MEDIUM 6.5 Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths cou
• CVE-2026-65765 MEDIUM 6.9 Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitatio
• CVE-2026-60025 HIGH 8.8 Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events
• CVE-2026-63280 HIGH 8.8 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditi
• CVE-2026-63684 HIGH 8.8 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import
• CVE-2026-64791 HIGH 8.8 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extensi
• CVE-2026-64876 HIGH 8.8 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - D
• CVE-2026-65944 HIGH 8.8 UPGRADE Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0
• CVE-2026-66492 MEDIUM 6.1 Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitatio
• CVE-2026-64794 MEDIUM 6.5 Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere ext
• CVE-2026-66493 MEDIUM 6.4 Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitatio
• CVE-2026-58149 MEDIUM 5.3 Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events
• CVE-2026-63265 HIGH 8.0 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs
• CVE-2026-65757 HIGH 8.1 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere ext
• CVE-2026-66488 MEDIUM 5.3 UPGRADE Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2
• CVE-2026-66489 MEDIUM 5.3 UPGRADE Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2
• CVE-2026-65891 MEDIUM 6.5 UPGRADE Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename
• CVE-2026-71574 MEDIUM 6.5 UPGRADE Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6
• CVE-2026-65947 HIGH 7.3 UPGRADE Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2
• CVE-2026-77993 MEDIUM 5.3 Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5 - The Joomla extension Page Builder
• CVE-2026-65762 MEDIUM 5.1 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation
• CVE-2026-65763 MEDIUM 5.1 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of u
• CVE-2026-65764 MEDIUM 5.1 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation
• CVE-2026-73336 MEDIUM 6.4 UPGRADE Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escap
• CVE-2026-77028 MEDIUM 5.3 Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo
• CVE-2026-60033 MEDIUM 5.1 Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0 - The Joomla extensio
• CVE-2026-66490 MEDIUM 6.1 UPGRADE Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2
• CVE-2026-71570 MEDIUM 5.1 Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend op
• CVE-2026-61901 MEDIUM 6.1 Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2 - The Joomla extension Hikashop is vulnera
• CVE-2026-65756 MEDIUM 6.1 Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accep
• CVE-2026-65882 MEDIUM 6.1 Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of th
• CVE-2026-65946 MEDIUM 6.1 UPGRADE Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0
• CVE-2026-67284 MEDIUM 5.3 Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.3 -
• CVE-2026-65712 MEDIUM 6.2 Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning c
• CVE-2026-71572 MEDIUM 5.4 UPGRADE Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - L
• CVE-2026-72531 MEDIUM 5.4 UPGRADE Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7,
• CVE-2026-72532 MEDIUM 5.4 UPGRADE Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0
• CVE-2026-64795 MEDIUM 5.4 Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - T
• CVE-2026-63281 MEDIUM 4.8 Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition v
• CVE-2026-64871 MEDIUM 5.4 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extens
• CVE-2026-73371 MEDIUM 4.3 UPGRADE Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An
• CVE-2026-73372 MEDIUM 4.3 UPGRADE Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 a
• CVE-2026-77029 MEDIUM 4.6 Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66

FAQ

How do I fix Joomla vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Joomla being exploited right now?

None of the tracked Joomla CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Joomla CVE should I patch first?

CVE-2026-65761 currently ranks highest (57/100): Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improp.

← Back to latest CVEs