A reflected cross-site scripting vulnerability has been discovered in the JoomShopping component. It allows an attacker to inject JavaScript code into a specially crafted link to a product page.
JoomShaper has released Helix Ultimate 2.2.11, an update that addresses six security issues. They affect embedded audio and video filtering, path handling, the Media Manager, article editing, article ratings, and Mega Menu badges.
A new guide explains how to reset a Joomla administrator password across the main releases from 1.0 to 6. Each method includes version compatibility notes, with separate instructions for legacy and modern password hashes, the SSH command, temporary access through configuration.php and the limitations of email recovery.
On October 21, 2026, the PHP developers released emergency security updates addressing two critical remote code execution (RCE) vulnerabilities: CVE-2026-109618 and CVE-2026-109619.
We have updated our collection of JoomShopping templates for Joomla, adding SJ Entry and a dedicated Flex9 overview, and revising Joomla 6 and 5 compatibility, prices and package contents. Explore 11 store designs, links to demos and developer websites, and practical advice on choosing a template.
404 Error Page 1.0.2 fixes error page layouts in Joomla. When a 404 error occurs within a component, the plugin applies the selected Joomla menu item’s settings, rebuilds breadcrumbs and uses the template style and modules assigned to that menu item. The Joomla error page no longer inherits the original page’s title, author and date display settings.
Update Log 1.0.28 for Joomla introduces an SEF links setting for reports, enabled by default. Aliases are generated automatically using the update-report-ID pattern, for example update-report-125. You can enter a custom alias on the report editing page, with uniqueness validation. To use search engine friendly URLs, enable SEF in Joomla's Global Configuration.
Joomla 6.2.0, code-named Mwezi, was officially released on 13 October 2026. This scheduled feature release introduces new tools for editors and administrators, improves TinyMCE integration, expands options for articles, categories and modules, and adds OAuth2 support for outgoing email.
On 8 October 2026, Balbooa released Gridbox 2.20.4.0. The new version fixes two security vulnerabilities: cross-site request forgery during language package installation and insufficient path validation in the image preview feature.
