iiinova — where your digital self keeps evolving

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 9h

CVE-2026-102427: OS CCK for Joomla let anyone upload and run PHP with no login. CVSS 10.0. Fixed in 8.3.16, but OrdaSoft's updater still offers 8.3.14, so install it by hand. mysites.guru/blog/ordasof...

Black card with a white file upload icon and the text: OS CCK Let Anyone Run PHP. Update to 8.3.16

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 10h

Quix Page Builder 6.3.4 is a security release. Guests could change Quix settings and read restricted pages, and editors could run code on the server. Update every Joomla site that runs it. mysites.guru/blog/quix-6-...

Dark card with a white shield and exclamation mark icon and the words: Quix 6.3.4 Fixes Guest Access and Editor Code Execution

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 14h

Joomla 5.4.9 and 6.1.4 fix 16 core security issues, two rated High. We read the code behind every advisory and ranked them by who can reach them: mysites.guru/blog/joomla-...

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 14h

AcyMailing writes its Joomla update site from PHP, not its manifest, so Joomla's Rebuild button deletes it for good. A quarter of AcyMailing sites below 11.1.0 we monitor have no update site. mysites.guru/blog/acymail...

Black card with a white unplugged cable icon and the words AcyMailing's Vanishing Update Site

000

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 18h

Balbooa Forms 2.4.3.4 fixes five security issues in the Joomla form builder: attachment path traversal, unauthenticated file deletion, stored XSS and PHP action hardening. 2.4.3.3 is affected: mysites.guru/blog/balbooa...

Black card with a white paperclip icon and the text: Balbooa Forms 2.4.3.4 fixes five security issues

000

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 18h

Every Joomla 4, 5 and 6 site answers on /api/ and most never use it. Joomla fixed eleven webservice flaws in 2026. How to switch it off, what breaks, and the .htaccess and Cloudflare rules. mysites.guru/blog/how-to-...

How to Disable the Joomla API (and What Breaks When You Do)

000

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 18h

A Joomla password reset does not touch API tokens, a separate credential checked against the site secret. mySites.guru now finds and revokes every one on a site in one click after a hack. mysites.guru/blog/how-to-...

Revoke Every Joomla API Token After a Hack

000

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 18h

A WordPress password reset does not revoke Application Passwords, a separate REST API credential. mySites.guru now revokes every one on a site in one click. mysites.guru/blog/how-to-...

Revoke Every WordPress Application Password After a Hack

000

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 22h

A rogue JCE editor profile is why some Joomla sites keep reinfecting. The profile grants the upload rights, so the shell comes back after every cleanup. mysites.guru/tools/hacked...

mySites.guru card: a person icon with a cross beside the words JCE Rogue Profiles.

000

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 29/09/2026

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 29/09/2026

A WordPress password reset does not revoke Application Passwords, a separate REST API credential. mySites.guru now revokes every one on a site in one click. mysites.guru/blog/how-to-...

000

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 29/09/2026

Real Estate Manager, Vehicle Manager and Book Library for Joomla each have an SQL injection that needs no login, hidden in the listing sort order. Six CVEs, three fixes. mysites.guru/blog/ordasof...

mySites.guru card: a white database icon with a lightning bolt on a dark background, next to the words OrdaSoft Joomla extensions: SQL injection with no login

000

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 29/09/2026

Joomla 5.4.9 and 6.1.4 fix 16 core security issues, two rated High. We read the code behind every advisory and ranked them by who can reach them: mysites.guru/blog/joomla-...

021

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 29/09/2026

mySites.guru uptime alerts now post to any webhook: Slack, Mattermost, Rocket.Chat, Discord, Microsoft Teams via Workflows, Google Chat, or HMAC-signed JSON for n8n, Zapier and Make. mysites.guru/blog/uptime-...

mySites.guru blog card: a white webhook icon beside the words Send Downtime Alerts to Teams, Google Chat, Discord or Your Own Code, on a near-black background

000

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 29/09/2026

Did you know? For every recent Joomla extension release, there have been six WordPress plugin releases. In other words, WordPress plugins have been released six times as often as Joomla extensions. releases.mysites.guru 4,088 releases tracked: 585 Joomla, 3,503 WordPress. That's a 1:6 ratio!

releases.mysites.guru

Manage Multiple WordPress/Joomla Sites in One Dashboard

The Award Winning Ultimate Toolset & Dashboard for Managing Unlimited WordPress/Joomla Sites

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 29/09/2026

012

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 29/09/2026

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 29/09/2026

A planted admin account is how an attacker keeps access after you close the hole. It often is not in the Super Users group, so checking that list misses it. mysites.guru/tools/hacked...

mySites.guru card: a shield with an exclamation mark beside the words Rogue Super Admin Accounts.

000

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 28/09/2026

Real Estate Manager, Vehicle Manager and Book Library for Joomla each have an SQL injection that needs no login, hidden in the listing sort order. Six CVEs, three fixes. mysites.guru/blog/ordasof...

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 28/09/2026

000

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 28/09/2026

Regular Labs fixed two content author security issues in Joomla extensions Modules Anywhere 10.0.0 and Tabs & Accordions 3.2.0. On 3.1.0 from September? Update again. mysites.guru/blog/regular...

mySites.guru card: a white shield with an exclamation mark beside the words Modules Anywhere 10.0.0 and Tabs & Accordions 3.2.0 security fixes, on a dark background

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 28/09/2026

mySites.guru is shortlisted for Your Favourite Tool in Your Joomla Workflow in Joomla's first J!Awards. Anyone can vote, no account needed, one form for all eight categories. Vote by 11 October: mysites.guru/blog/joomla-...

Vote for mySites.guru in the Joomla J!Awards, in white text beside a white trophy icon on a black background

011

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 27/09/2026

Regular Labs fixed two content author security issues in Joomla extensions Modules Anywhere 10.0.0 and Tabs & Accordions 3.2.0. On 3.1.0 from September? Update again. mysites.guru/blog/regular...

021

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 27/09/2026

UP, a Joomla plugin, let anyone read configuration.php and trigger a code download from GitHub with TLS checks off. We reported it in August, and 6.1.0 and 5.2.1 fix it. mysites.guru/blog/up-plug...

mySites.guru blog card: UP 6.1.0 fixes file read and code execution, white text beside a code-file icon on a dark background

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 27/09/2026

AcyMailing 11.1.0's two quiet security fixes now have CVEs: CVE-2026-94132, a mailbox file write rated 9.5 Critical, and CVE-2026-94131, a file deletion. The changelog still says Bug fixes. mysites.guru/blog/acymail...

mySites.guru blog card: AcyMailing 11.1.0 Fixes Two Security Flaws, white text and an icon on a dark background

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 27/09/2026

Event Gallery 6.5.0's notes now lead with security: five advisories for this Joomla extension, the worst a Clear Cache path traversal that could delete any writable folder. Update every site. mysites.guru/blog/event-g...

Event Gallery 6.5.0 security release card: white icon and headline on a dark background, with an UPDATED banner

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 27/09/2026

CVE-2026-94130: an unauthenticated SQL injection in YouTube Gallery for Joomla, 9.3 Critical. Everything below 5.7.3 is affected, and old 4.x builds get no patch of their own. Update now: mysites.guru/blog/youtube...

Dark card with a white database-and-lightning icon and the text: YouTube Gallery SQL Injection Fixed in 5.7.3

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 27/09/2026

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 27/09/2026

000

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 26/09/2026

UP, a Joomla plugin, let anyone read configuration.php and trigger a code download from GitHub with TLS checks off. We reported it in August, and 6.1.0 and 5.2.1 fix it. mysites.guru/blog/up-plug...

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 26/09/2026

Event Gallery 6.5.0 fixes an upload CSRF, a reflected XSS and guessable order IDs in Joomla. The notes run to 8,673 words and never say update now. mysites.guru/blog/event-g...

Dark card with a white image-upload icon and the words Event Gallery 6.5.0 Hides Its Security Fixes

011

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 26/09/2026

AcyMailing 11.1.0 fixes a file deletion flaw and a mailbox file-write flaw. No CVE, no advisory: two one-liners under Bug fixes and a dot you hover over. mysites.guru/blog/acymail...

Dark card with a white bug icon and the text: AcyMailing 11.1.0 - Security Release, Filed Under Bug Fixes

000

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 26/09/2026

30,305 live Joomla 3 sites in our portfolio, hacked at 5x the Joomla 6 rate. The twist: Joomla 4, the version everyone migrated to, is now the worst-maintained branch we track. mysites.guru/blog/joomla-...

mySites.guru card: a baby face icon beside the words Joomla 3 Didn't Fail. Your Retainer Did.

031

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 26/09/2026

New on the mySites.guru API and MCP server: one call returns every site in your account, with versions, updates, vulnerabilities, backups and a needs-attention flag. mysites.guru/blog/mysites...

mySites.guru blog card: a white checklist icon beside the words Every Site, One API Call on a dark background.

000

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 25/09/2026

Joomla can still email a new user their actual password in plain text. Not a reset link, the password. Joomla itself recommends against it. mysites.guru/tools/joomla...

mySites.guru card: an envelope with a cross beside the words Plain Text Passwords In Email.

000

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 25/09/2026

New on the mySites.guru API and MCP server: one call returns every site in your account, with versions, updates, vulnerabilities, backups and a needs-attention flag. mysites.guru/blog/mysites...

011

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 25/09/2026

022

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 25/09/2026

Before EasyStore 3.0.1, any visitor could get a Joomla shop customer's home address and phone number just from their email. mySites.guru found it and six more flaws. Update now. mysites.guru/blog/easysto...

Black card with a white shopping cart icon and the words: EasyStore 3.0.0 - Seven Flaws on Release Day

001

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 24/09/2026

AcyMailing 11.1.0 fixes a file deletion flaw and a mailbox file-write flaw. No CVE, no advisory: two one-liners under Bug fixes and a dot you hover over. mysites.guru/blog/acymail...

011

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 24/09/2026

The whole mySites.guru platform now runs on PHP 8.5.11 & Symfony 8.1.7 What is your excuse for not keeping your websites up to date and on the latest PHP and platform versions the same day new ones are released? A big thanks to the @Symfony and #FrankenPHP projects for a rock solid platform.

mysites.guru

mySites.guru - WordPress & Joomla Site Manager

Manage unlimited WordPress & Joomla sites from one dashboard. Security audits, bulk updates, backups & uptime monitoring. Trusted by 90,000+ sites.

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 24/09/2026

New in mySites.guru: a web-based File Manager for Joomla and WordPress. Already connected, off by default, no passwords, every action logged. No price rise since 2010. mysites.guru/blog/web-fil...

mySites.guru card: a padlocked folder icon beside the words The mySites.guru Web File Manager.

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 24/09/2026

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 23/09/2026

A staff member leaves on Friday. Their account exists on 1,000 of the Joomla and WordPress sites you look after. How are you deleting all 1,000 by Monday? mysites.guru/blog/manage-...

mySites.guru card: a group of people icon beside the words Users, across every site you manage.

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 23/09/2026

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 23/09/2026

When you are so proud of your 3.0 release... that you forget to check its security and within a few hours 7 security issues are reported (plus others) and it takes you several weeks to make a 3.0.1 release #facepalm

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 23/09/2026

010

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 22/09/2026

Recently we added a load of WordPress features after fixing a specific hack on a clients WP site... we told you about the new cron checks and rouge admin checks for WP in mySites.guru Well today @WordFence has caught up and written up: www.wordfence.com/blog/2026/09...

mysites.guru

mySites.guru - WordPress & Joomla Site Manager

Manage unlimited WordPress & Joomla sites from one dashboard. Security audits, bulk updates, backups & uptime monitoring. Trusted by 90,000+ sites.

000

Manage Multiple WordPress and Joomla Sites easily! @mysites.guru · 22/09/2026

Balbooa patched Gridbox 2.20.3.1: an unauthenticated blind SQL injection in the page builder's blog author filter. No login, and it can read a site's whole database. If you run Gridbox, update now: mysites.guru/blog/gridbox...

Blind SQL injection in Gridbox's blog author filter, fixed in Gridbox 2.20.3.1

000