htprotect.org collects current, critical security vulnerabilities of popular Joomla extensions and frameworks – factual, free and with step-by-step guides that are easy to follow even for beginners. The goal: warn those affected quickly and help them close the gaps.
Six current flaws rated as critical. Check the installed versions – details and guides per entry.
Each flaw briefly outlined – one click leads to the detailed, beginner-friendly guide.
Several serious flaws were disclosed in the AJAX plugin of JoomShaper's Helix3 template framework – including writing and deleting files and uploading PHP code without logging in. All versions before 3.1.1 are affected; the 3.1.1 fix is available via the normal Joomla updater. Note: Helix3 is not the same as the newer Helix Ultimate.
In the widely used Astroid Framework, a critical flaw allows files to be uploaded without any authentication – and, in the worst case, code execution (RCE). Versions 2.0.0 to 3.3.10 are affected; fixed from 3.3.11, with 3.3.13 or newer recommended (CVE-2026-21628). Already-compromised sites often show injected plugins such as "BLPayload" or "JCachePro".
The Tassos Framework (formerly Novarain) sits unnoticed inside many popular extensions such as Convert Forms or EngageBox. Unauthenticated AJAX calls allow file and database access – rated critical at CVSS 9.5, with a public exploit tool available (CVE-2026-21627). It is enough to update any one Tassos extension: the framework is automatically raised to a secure version (6.0.62+).
JCE is one of the most-used editors for Joomla. Insufficient access control allowed unauthenticated attackers to upload editor profiles and, through them, arbitrary files – and the flaw is already being actively exploited to plant web shells. All versions before 2.9.99.5 are affected (Free and Pro), regardless of whether registration is enabled. Secure is 2.9.99.5, better the follow-up 2.9.99.6.
iCagenda is a popular event calendar for Joomla. The form for submitting events lacked a real login check – so even unauthenticated attackers could upload files, even when the form was supposedly restricted to registered users. All versions before 4.0.8 are affected; the 4.0.8 fix was released on 15 June 2026.
SP Page Builder is one of the most-used page builders for Joomla. A zero-day flaw in the custom-icon upload function checked neither login nor file type, allowing code execution (RCE) without a login. The entire 6.x series up to and including 6.6.1 is affected; the emergency update 6.6.2 closes the hole. It is already being actively exploited and leaves behind hidden super-users and backdoors.
Almost all of the flaws described here are closed the same way – via the Joomla update center. This general guide is for beginners:
Open the Joomla administrator (your domain with /administrator appended) and log in.
Go to System›Update›Extensions and click Check for updates.
Select the affected extension from the list and click Update. Joomla downloads and installs the new version automatically.
Then check the installed version number (component or Extensions›Manage) and compare it with the "secure version" on the relevant detail page.
An update closes the hole but does not remove malware already injected. If anything looks off, have the site professionally cleaned and change all passwords.
HTProtect
Many of the flaws listed here follow the same pattern: unauthenticated file upload. This is exactly where HTProtect comes in – as an additional layer of protection for Joomla that does not, however, replace a vendor update.
.htaccess never sees.Note: HTProtect does not replace updates. The most effective measure remains applying vendor updates promptly – HTProtect reduces the risk in the window beforehand and reports anomalies.
htprotect.org is a free, vendor-independent information service. It is supported by:
Joomla host from Germany with active community support – discovered the first attack on the JCE vulnerability.
fc-hosting.de
Specialised in cleaning, maintaining and securing Joomla and WordPress websites.
website-bereinigung.deYou run a hosting or Joomla service and would like to support htprotect.org – and be listed here as a supporter? Every contribution helps to warn and protect those affected faster.