Still running Joomla 3?
Joomla! 3
Security
Patch.
+ PHP 8 Compatibility
Closes 50 known security vulnerabilities in the Joomla! 3 core and fixes 7 PHP 8 deprecation issues in the code every request loads. Every fix is individually verified, backed up automatically, with one click to apply and one click to undo.
Independent third-party patch for Joomla! 3
50
verified security fixes
7
PHP 8 compatibility fixes
1 click
apply & undo anytime
57 / 57 rules satisfied · PATCHED
Why this matters
Joomla! 3 reached official end-of-life on August 17, 2023. No more official security updates are released, yet a large share of the web still runs on it.
No official fixes
New vulnerabilities keep being found in code shared with newer Joomla! versions, but Joomla! 3 itself no longer gets a patch.
Hosts are dropping PHP 7.4
Forced upgrades to PHP 8.x break the unpatched Joomla! 3 core outright in places, including the admin panel.
Migration isn’t always an option
Moving to Joomla! 4/5 takes budget and time many operators don’t have right now, but running unpatched isn’t acceptable either. Patch or migrate, compared →
What’s included
Two independent tracks in one package: apply them separately, on your own schedule.
Security
50 verified fixes
41 tied to an official CVE, 9 independently identified hardening measures. Every fix is individually researched, verified against the real 3.10.12 core, and rated for confidence. Low-confidence candidates are never shipped.
| Class | Count |
|---|---|
| XSS / Cross-Site-Scripting | 24 |
| Access control / authentication | 9 |
| Other hardening | 4 |
| SQL injection | 2 |
| Cache poisoning | 2 |
| Timing attacks | 2 |
| File upload / RCE | 2 |
| Open redirect | 2 |
| Path traversal / LFI | 1 |
| PHP object injection | 1 |
| Information disclosure | 1 |
Each fix is compared against the corresponding upstream Joomla! or community-fork change, adapted to the 3.10.x line, and re-verified by reading the affected code, not copied blindly. All 57 fixes carry a passing smoke test against a real 3.10.12 core; 45 are rated high confidence and 12 medium. Nothing rated low confidence ships.
View all 57 fixes and CVEs →
| ID | Type | CVE | Class | File | Confidence |
|---|---|---|---|---|---|
| JP3-0001 | Security | CVE-2025-54476 | XSS filter bypass | InputFilter.php | High |
| JP3-0002 | Security | CVE-2025-63083 | Stored XSS | toc.php | High |
| JP3-0003 | Security | CVE-2026-21629 | Missing authentication check | ajax.php | High |
| JP3-0004 | Security | CVE-2026-48954 | Stored XSS (attribute-breakout) | languageoverridequotes.php +2 more | High |
| JP3-0005 | Security | CVE-2026-48950 | Reflected XSS | default.php | Medium |
| JP3-0006 | Security | CVE-2026-48953 | XSS via public layout API | image.php | Medium |
| JP3-0007 | Security | CVE-2026-48952 | XSS via untrusted update feed data | default.php | Medium |
| JP3-0008 | Security | CVE-2026-25901 | Stored XSS | edit.php | Medium |
| JP3-0009 | Security | CVE-2026-30894 | Stored XSS | preview.php | High |
| JP3-0010 | Security | CVE-2026-25900 | XSS via untrusted RSS feed | default.php +1 more | High |
| JP3-0011 | Security | CVE-2026-30895 | Stored XSS | readmore.php +1 more | Medium |
| JP3-0012 | Security | CVE-2026-40383 | Path traversal to local file inclusion | HtmlView.php | High |
| JP3-0013 | Security | CVE-2026-35222 | SQL injection | tags.php +1 more | High |
| JP3-0014 | Security | CVE-2026-48902 | Sensitive token sent over cleartext HTTP | reset.php +1 more | High |
| JP3-0015 | Security | CVE-2026-48901 | Cache poisoning / incorrect filter reuse | InputFilter.php | High |
| JP3-0016 | Security | CVE-2026-48948 | Broken access control | view.vcf.php | High |
| JP3-0017 | Security | CVE-2025-63082 | XSS via data: URI | InputFilter.php | High |
| JP3-0018 | Security | CVE-2024-40747 | XSS via module style/attribute parameters | ModuleHelper.php | High |
| JP3-0019 | Security | CVE-2025-25226 | SQL injection via identifier quoting bypass | driver.php | High |
| JP3-0020 | Security | CVE-2026-21631 | Stored XSS | edit.php | High |
| JP3-0021 | Security | — | Missing authorization check | update.php | High |
| JP3-0022 | Security | — | Timing side-channel | totp.php | High |
| JP3-0023 | Security | — | Missing request/response authentication | yubikey.php +3 more | High |
| JP3-0024 | Security | — | PHP object injection (defense-in-depth) | restore.php | Medium |
| JP3-0025 | Security | — | XSS via untrusted external feed | default.php | High |
| JP3-0026 | Security | — | Timing side-channel (limited real-world impact) | reset.php | Medium |
| JP3-0027 | Security | — | Code hygiene (eval removal) -- not found to be exploitable | HtmlDocument.php | Medium |
| JP3-0028 | Security | — | Remote code execution via file upload bypass | MediaHelper.php | High |
| JP3-0029 | Security | — | Content-type sniffing bypass (upload XSS) | MediaHelper.php | High |
| JP3-0030 | Security | CVE-2023-40626 | Information disclosure (env var / PHP constant exposure) | LanguageHelper.php +28 more | High |
| JP3-0031 | Security | CVE-2024-21723 | Open redirect | framework.php | High |
| JP3-0032 | Security | CVE-2024-27184 | Improper URL validation (open redirect / SSRF-adjacent) | Uri.php | High |
| JP3-0033 | Security | CVE-2024-21724 | XSS via unvalidated media-field value | banner.xml +28 more | High |
| JP3-0034 | Security | CVE-2024-26279 | XSS via malicious wrapper URL (javascript:/data: schemes) | default.xml +1 more | High |
| JP3-0035 | Security | CVE-2024-21726 | XSS filter gap in the URL form-validation rule | UrlRule.php +1 more | High |
| JP3-0036 | Security | CVE-2024-21731 | XSS via entity-encoded tag surviving strip_tags then getting decoded live | string.php | High |
| JP3-0037 | Security | CVE-2024-40743 | XSS via case-mixed or nested tag surviving a single-pass, case-sensitive strip regex | OutputFilter.php | High |
| JP3-0038 | Security | CVE-2024-27185 | Cache poisoning via arbitrary parameter injection into cached pagination links | Pagination.php | High |
| JP3-0039 | Security | CVE-2024-21722 | Insufficient session expiration after MFA method change | user.php +1 more | High |
| JP3-0040 | Security | CVE-2024-21725 | XSS via punycode-decoded email/URL containing HTML-special characters | default.php +7 more | Medium |
| JP3-0041 | Security | CVE-2024-26278 | Stored XSS via unsanitized custom-field default value | field.xml | High |
| JP3-0042 | Security | CVE-2024-27187 | Improper access control (self-service privilege/identity tampering) | user.php | Medium |
| JP3-0043 | Security | CVE-2026-48898 | Missing authorization check (defense-in-depth; does not close a currently-reachable 3.x gap) | user.php | Medium |
| JP3-0044 | Security | CVE-2026-73371 | Improper access control (batch-copy items the user cannot edit) | AdminModel.php +4 more | High |
| JP3-0045 | Security | CVE-2026-48956 | Missing authorization check (defense-in-depth for a non-standard entry point) | controller.php | Medium |
| JP3-0046 | Security | CVE-2026-71572 | HTTP header injection via unsanitized filename | view.raw.php +1 more | High |
| JP3-0047 | Security | CVE-2026-73373 | Remote code execution via file upload bypass (SSI-executable extension) | template.php | High |
| JP3-0048 | Security | CVE-2026-21632 | Stored XSS via unescaped article title | blog_links.php +6 more | High |
| JP3-0049 | Security | CVE-2024-40748 | XSS via unescaped HTML id attribute | default.php | High |
| JP3-0050 | Security | CVE-2024-40749 | Access control bypass via case-insensitive class resolution vs. case-sensitive ACL check | controller.php +1 more | High |
| JP3-0051 | PHP 8 | — | PHP 8.1 compatibility (Serializable interface deprecation notice, not a vulnerability) | Input.php +1 more | High |
| JP3-0052 | PHP 8 | — | PHP 8.1 compatibility (SPL interface return-type deprecation, not a vulnerability) | Feed.php | High |
| JP3-0053 | PHP 8 | — | PHP 8.4 compatibility (implicit-nullable-parameter deprecation, not a vulnerability) | BaseApplication.php +6 more | High |
| JP3-0054 | PHP 8 | — | PHP 8.1 compatibility (SPL interface return-type deprecation, not a vulnerability) | iterator.php | High |
| JP3-0055 | PHP 8 | — | PHP 8.1 compatibility (SPL interface return-type deprecation, not a vulnerability) | iterator.php | High |
| JP3-0056 | PHP 8 | — | PHP 8.1 compatibility (SPL interface return-type deprecation, not a vulnerability) | DataSet.php | High |
| JP3-0057 | PHP 8 | — | PHP 8.1 compatibility (SPL interface return-type deprecation, not a vulnerability) | Input.php | High |
As of August 2026. Prefer a standalone, linkable page? View the full CVE list →
Compatibility
7 PHP 8 fixes
Stops the core from throwing deprecation errors under PHP 8.1+, including the application bootstrap classes that load on every single page request. Purely additive, safe on PHP 7.4 too. See the actual error messages →
- Input.php (2 fixes): Serializable and Countable interface compliance, the class loaded on every request
- Application bootstrap (7 files): highest-reachability fix, every front-end and admin request
- Feed.php: used by mod_feed and com_newsfeeds
- JDatabaseIterator & FOFDatabaseIterator: optional APIs some extensions call
- Joomla\Data\DataSet: closes the class fully for any extension that references it
How it works
Installs as a normal, protected Joomla! extension. No SSH or database access required.
-
Install
Extensions → Manage → Install → upload the package file.
-
Scan
Open Scan & Apply and see live which of the 57 rules are already satisfied and which are missing.
-
Apply
Apply the missing security fixes with one click. Every change is backed up automatically first.
-
Toggle PHP 8
Turn on PHP 8 compatibility separately, whenever your hosting moves. Also one click, reversible any time.
Safe by design
What actually happens to your files before, during, and after a fix is applied.
Backup before every change
Any file about to be overwritten is copied to a dated backup folder inside the extension first, every time, no exceptions.
Unrecognized files are skipped
Each file is checked against a known pattern before touching it. If the surrounding code no longer matches (e.g. a third-party mod changed it), that fix is skipped for manual review, not force-applied.
Restore any fix, anytime
Every applied fix can be individually reverted from its backup. If a restore can’t fully complete, you’re told explicitly instead of being left guessing.
Two honest limits: when a fix does apply, it replaces the affected file’s full content rather than merging line-by-line, so unrelated custom edits inside that specific file could be lost. Check the file list for a fix against your own changes first if you’re unsure. And fixes aren’t transactional across a batch: if one fix in a multi-fix run fails partway through, files already changed by earlier fixes in that run are not automatically rolled back. The backup is always there to restore manually.
Inside the admin panel
Real screenshots from the Scan & Apply admin screen: this is what you’ll see after install.
Frequently asked questions
Does this replace migrating to Joomla! 4 or 5?
No. It’s a stopgap that keeps a Joomla! 3 site secure and running on current PHP versions while you plan a migration, not a substitute for one.
Will it work if my Joomla! core files have already been modified?
Each file is checked for the actual vulnerable pattern before it’s touched. If that pattern is still recognizable, the fix applies (after backing the file up). If the surrounding code no longer matches any known pattern, that fix is skipped and flagged for manual review instead of being force-applied. One thing to know: when a fix does apply, it replaces the file’s full content rather than merging line-by-line, so unrelated custom edits inside that specific file could be lost. Check the fix’s file list against your own changes first if you’re unsure.
Does it patch third-party extensions or templates?
No. Every fix only ever touches Joomla! core files.
Which PHP versions are actually supported?
The 7 compatibility fixes close deprecation warnings introduced across PHP 8.1 through 8.4 in code that runs on every request, and they’re verified against real PHP 7.4 and 8.1 interpreters. They stop the Joomla! core itself from throwing those warnings, but they don’t guarantee the rest of your admin area runs error-free on PHP 8.1+ if your templates or third-party extensions aren’t PHP 8-compatible themselves.
Can I undo every change?
Yes. Every applied fix can be individually restored from its automatic backup. If a restore can’t fully complete, you’re told explicitly instead of being left guessing. Check the backup folder manually in that case.
How many websites does one license cover?
One Joomla! installation. Installing on staging and production of the same website is covered by the same license.
Does the extension stay installed permanently?
Yes. It installs as a protected extension and isn’t meant to be removed via the normal Uninstall button. The included installation guide covers the correct way to remove it if you ever need to.
Is this a subscription? Do I get future fixes too?
No. This is a one-time purchase covering the 57 fixes in the current package. New vulnerabilities discovered after your purchase are not automatically included. Check joomla-update.ch for future package updates.
One-time purchase
No subscription. Covers the 57 fixes in the current package.
Joomla! 3 Security Patch + PHP 8 Compatibility
$19.90 one-time
Instant download after purchase, including an installation guide.
Get the patch- 50 verified security fixes (41 with CVE, 9 hardening)
- 7 PHP 8 compatibility fixes
- Scan & Apply admin interface
- Automatic backup, reversible any time
- Works with Joomla! 3.10.12 and 3.10.x forks
- One license per Joomla! installation, staging and production of the same website included
Deliberately not included
- Vulnerabilities in third-party extensions or templates: the patch only ever touches Joomla! core files
- Full PHP 8.1+ compatibility of Joomla! 3’s own admin area: the compatibility fixes stop the core from throwing deprecation warnings, but don’t guarantee every admin screen runs cleanly on PHP 8.1+ without further work
- A guarantee the entire admin area runs error-free on PHP 8.1 if third-party components aren’t PHP 8-compatible themselves
- Protection against future, not-yet-disclosed vulnerabilities (zero-days)
Already hacked?
This patch prevents known vulnerabilities. It won’t clean up an active compromise. If your Joomla 3 site is already showing signs of a hack (spam pages, redirects, a defaced homepage, a host warning), get in touch and we’ll help you assess and fix it.
Get in touch