---
title: "Official Joomla! Announcements"
description: "We help designers, developers, hobbyists and business owners get the most out of the Joomla CMS.  Join us at our free monthly meetups, and let us help you with your Joomla projects."
url: "https://www.joomlalondon.co.uk/official-joomla-announcements?start=225"
date: "2026-09-09T14:31:48+00:00"
language: "en-GB"
---

#  Official Joomla! Announcements

##  [ \[20190302\] - Core - XSS in item\_title layout ](https://www.joomlalondon.co.uk/official-joomla-announcements/20190302-core-xss-in-item-title-layout)

- **Project:** Joomla!
- **SubProject:** CMS
- **Impact:** Low
- **Severity:** Low
- **Versions:** 3.0.0 through 3.9.3
- **Exploit type:** XSS
- **Reported Date:** 2019-February-25
- **Fixed Date:** 2019-March-12
- **CVE Number:** [CVE-2019-9711](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9711)

### Description

The item\_title layout in edit views lacks escaping, leading to a XSS vulnerability.

### Affected Installs

Joomla! CMS versions 3.2.0 through 3.9.3

### Solution

Upgrade to version 3.9.4

### Contact

The JSST at the [Joomla! Security Centre](https://developer.joomla.org/security-centre.html "Contact the JSST").

**Reported By:** Fouad MaakorRead more  [http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/uD680RYCbkk/773-20190302-core-xss-in-item-title-layout.html](http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/uD680RYCbkk/773-20190302-core-xss-in-item-title-layout.html "[20190302] - Core - XSS in item_title layout")

##  [ \[20190303\] - Core - XSS in media form field ](https://www.joomlalondon.co.uk/official-joomla-announcements/20190303-core-xss-in-media-form-field)

- **Project:** Joomla!
- **SubProject:** CMS
- **Impact:** Low
- **Severity:** Low
- **Versions:** 3.0.0 through 3.9.3
- **Exploit type:** XSS
- **Reported Date:** 2019-February-25
- **Fixed Date:** 2019-March-12
- **CVE Number:** [CVE-2019-9714](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9714)

### Description

The media form field lacks escaping, leading to a XSS vulnerability.

### Affected Installs

Joomla! CMS versions 3.2.0 through 3.9.3

### Solution

Upgrade to version 3.9.4

### Contact

The JSST at the [Joomla! Security Centre](https://developer.joomla.org/security-centre.html "Contact the JSST").

**Reported By:** Fouad MaakorRead more  [http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/-7y5ceiY85g/774-20190303-core-xss-in-media-form-field.html](http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/-7y5ceiY85g/774-20190303-core-xss-in-media-form-field.html "[20190303] - Core - XSS in media form field")

##  [ XLSJuice ](https://www.joomlalondon.co.uk/official-joomla-announcements/xlsjuice)

Joomla Integration for calculators built using **XLSJuice spreadsheet to web converter**.

If you have a working spreadsheet, you can convert to webpage using XLSJuice and then publish as a Joomla module using this extension.

You can build any form calculator that will automatically include all excel functions, format, validators, charts... and many other extra features like sending emails, generate PDFs, dynamic sections and integrations with external systems (Mailchimp, vTiger, etc...)

Read more  [http://feeds.joomla.org/~r/JoomlaExtensions/~3/JPBwlIw2DYQ/xlsjuice](http://feeds.joomla.org/~r/JoomlaExtensions/~3/JPBwlIw2DYQ/xlsjuice "XLSJuice")

##  [ \[20190206\] - Core - Implement the TYPO3 PHAR stream wrapper ](https://www.joomlalondon.co.uk/official-joomla-announcements/20190206-core-implement-the-typo3-phar-stream-wrapper)

- **Project:** Joomla!
- **SubProject:** CMS
- **Impact:** Low
- **Severity:** Low
- **Versions:** 2.5.0 through 3.9.2
- **Exploit type:** Object Injection
- **Reported Date:** 2019-January-18
- **Fixed Date:** 2019-February-12
- **CVE Number:** [CVE-2019-7743](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7743)

### Description

The phar:// stream wrapper can be used for objection injection attacks. We now disallow usage of the phar:// handler for non .phar-files within the CMS globally by implementing the TYPO3 PHAR stream wrapper.

### Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.2

### Solution

Upgrade to version 3.9.3

### Contact

The JSST at the [Joomla! Security Centre](https://developer.joomla.org/security-centre.html "Contact the JSST").

David Jardin (JSST)Read more  [http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/fkS3WGexLko/770-20190206-core-implement-the-typo3-phar-stream-wrapper.html](http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/fkS3WGexLko/770-20190206-core-implement-the-typo3-phar-stream-wrapper.html "[20190206] - Core - Implement the TYPO3 PHAR strea")

##  [ \[20190205\] - Core - XSS Issue in core.js writeDynaList ](https://www.joomlalondon.co.uk/official-joomla-announcements/20190205-core-xss-issue-in-core-js-writedynalist)

- **Project:** Joomla!
- **SubProject:** CMS
- **Impact:** Low
- **Severity:** Low
- **Versions:** 2.5.0 through 3.9.2
- **Exploit type:** XSS
- **Reported Date:** 2018-October-07
- **Fixed Date:** 2019-February-12
- **CVE Number:** [CVE-2019-7740](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7740)

### Description

Inadequate parameter handling in JS code could lead to an XSS attack vector.

### Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.2

### Solution

Upgrade to version 3.9.3

### Contact

The JSST at the [Joomla! Security Centre](https://developer.joomla.org/security-centre.html "Contact the JSST").

Dimitris GrammatikogiannisRead more  [http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/RdrIyFYmwgI/769-20190205-core-xss-issue-in-core-js-writedynalist.html](http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/RdrIyFYmwgI/769-20190205-core-xss-issue-in-core-js-writedynalist.html "[20190205] - Core - XSS Issue in core.js writeDyna")

1. [ \[20190204\] - Core - Stored XSS issue in the Global Configuration help url #2](https://www.joomlalondon.co.uk/official-joomla-announcements/20190204-core-stored-xss-issue-in-the-global-configuration-help-url-2)

2. [ JoomDIY](https://www.joomlalondon.co.uk/official-joomla-announcements/joomdiy)
3. [ JMG Team](https://www.joomlalondon.co.uk/official-joomla-announcements/jmg-team)
4. [ Zapier for Convert Forms](https://www.joomlalondon.co.uk/official-joomla-announcements/zapier-for-convert-forms)

 Page 46 of 55

## Schema

```json
{ "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Start", "item": "https://www.joomlalondon.co.uk" }, { "@type": "ListItem", "position": 2, "name": "Official Joomla! Announcements", "item": "https://www.joomlalondon.co.uk/official-joomla-announcements" } ] }
```