Joomla’s documented article removal process is a two-stage workflow: first, articles are sent to Trash, and then they can be permanently removed from Trash. This tutorial explains that bulk deletion path for a filtered set of articles in the Articles list, using the administrator interface and the...
A Joomla extension update that contains a security fix should be clearly distinguishable from a routine feature or maintenance release. Using the documented <security> update metadata mechanism can help site owners and their management processes recognise releases that deserve prompt attention, but it is only a...
Phoca Cart 6.1.9 addresses a paid-download insecure direct object reference (IDOR) issue that Joomla shop owners should remediate promptly, particularly where digital products are sold. The update is distinct from two earlier, CVE-tracked cross-site scripting flaws fixed in version 6.1.8, so...
A missing AcyMailing update site can prevent Joomla administrators from seeing an available security update. This operational issue matters because AcyMailing Enterprise versions 6.0.0 through 11.0.5 are affected by two unauthenticated vulnerabilities fixed in version 11.1.0 or later.
When a Joomla site may have been compromised, patching the software is necessary but does not by itself resolve the risk from credentials issued before the incident. This guide explains how to assess Joomla API token exposure, revoke and replace tokens safely, and respond to two verified Joomla...
Six confirmed Joomla extension vulnerabilities affect the Free editions of OrdaSoft Real Estate Manager, Vehicle Manager and Book Library. Site owners should update the first two extensions immediately and treat Book Library versions through 6.4.6 as vulnerable while waiting for an explicitly...
Joomla administrators using Regular Labs Modules Anywhere or Tabs & Accordions should update to versions 10.0.0 and 3.2.0 respectively as a prudent security measure. However, two CVE identifiers initially associated with those releases are officially assigned to Event Gallery for Joomla, so...
Administrators using the UP (Universal Plugin) for Joomla should urgently identify and update affected releases. Four verified vulnerabilities include unauthenticated arbitrary file access, SQL injection and remote code installation risks, with fixes available in UP 6.1.0 for Joomla 5.2–6.x and UP...
AcyMailing 11.1.0 adds security-related fixes for mailbox uploads and file fields, making a prompt update advisable for Joomla sites using the extension. The release also follows a confirmed Joomla SQL injection fixed in 10.11.1, so administrators should verify that their installation is now at...
EasyStore for Joomla versions 1.0.0 through 3.0.0 are affected by seven documented security vulnerabilities, including an unauthenticated exposure of guest checkout shipping details. Store owners should update to EasyStore 3.0.1 or later, then review backend access, mail settings, and relevant logs.
Four confirmed Joomla extension vulnerabilities affect OrdaSoft OS Gallery, including its free edition, in versions 1.0.0 through 6.2.6. Site owners should update to OS Gallery 6.2.7 or later, review component permissions, and check for signs of unusual database or file activity.
A Joomla directory website does not have to begin with a specialist directory extension. For a simple, editorially managed directory, Joomla core can provide a practical foundation: store each business or organization as an article, arrange listings in article categories, record structured details in...
SP Page Builder 6.9.1 addresses six Joomla extension vulnerabilities affecting Free and Pro installations, including an authenticated blind SQL injection, unauthenticated CAPTCHA bypasses in Pro form addons, and media and menu access-control flaws. Site owners running version 6.9.0 or earlier...
Two unauthenticated vulnerabilities in SP Property Finder affect versions 1.0.0 through 4.1.3: a Critical SQL injection issue and a mail relay–style form abuse issue. Joomla administrators should update to version 4.1.4 or later, then review database, administrator, and mail activity for signs of...
