# Joomla 3 Security Joomla 3 has been end of life since 17 August 2023 and the paid eLTS programme ended on 17 February 2025. This site, published by mySites.guru, sets out the dates, what each extension vendor has said about Joomla 3, the core and extension vulnerabilities still open on Joomla 3 sites, and how mySites.guru keeps those sites patched while owners plan a move. ## Pages - [Joomla 3 end of life: what it means for your site](https://joomla3security.com/): The verdict, key dates and your options. - [Joomla 3 end of life timeline](https://joomla3security.com/timeline/): Every dated release, vendor statement and patch from 2012 to today. - [Joomla 3 extension vendors](https://joomla3security.com/vendors/): Which vendors still ship security fixes for Joomla 3, which stopped and which stayed silent. - [Unpatched Joomla 3 core vulnerabilities](https://joomla3security.com/core-vulnerabilities/): The 39 core advisories fixed for Joomla 3 only by the mySites.guru one-click patch. - [Joomla 3 extension vulnerabilities](https://joomla3security.com/extension-vulnerabilities/): Joomla extension flaws that reach Joomla 3 branches, with severity and affected versions. - [Your options for a Joomla 3 site](https://joomla3security.com/options/): Stay and patch, rescue projects, or migrate, and the PHP deadline your host sets. - [How mySites.guru helps with Joomla 3](https://joomla3security.com/how-mysites-guru-helps/): The one-click core patch, JoomShaper packages, warnings and vulnerable extension alerts. - [Joomla 3 security FAQ](https://joomla3security.com/faq/): Short answers on end of life, eLTS, patching and the free trial. - [Joomla 3 security reading list](https://joomla3security.com/reading/): Every mySites.guru post on Joomla 3, newest first. ## Vendors - [Akeeba and Joomla 3](https://joomla3security.com/vendors/akeeba/): Called Akeeba Backup 8.3.3 the final version for Joomla 3 in August 2023, then published a revised policy two days after its own August 2024 cut-off and was still shipping Joomla 3 releases in May 2025. - [Balbooa and Joomla 3](https://joomla3security.com/vendors/balbooa/): Said in April 2025 that no future version of Balbooa Forms would be compatible with Joomla 3.x, then in July 2026 published and hosted a Joomla 3 compatibility patch written by a community member. - [Digital Peak and Joomla 3](https://joomla3security.com/vendors/digital-peak/): Put the DPCalendar 8.x line for Joomla 3 into hybrid maintenance mode in May 2024 and still backports security fixes to it: 8.19.4, 8.19.5 and 8.19.6 all shipped for Joomla 3 in 2026. - [Extly and Joomla 3](https://joomla3security.com/vendors/extly/): Extended Joomla 3 support until at least the end of 2024 and said it would review the decision during that year. We found no later statement. - [Fabrik and Joomla 3](https://joomla3security.com/vendors/fabrik/): Will not backport any security work to Fabrik 3 and says it cannot publish Fabrik 3 releases at all. For the 2026 calc element flaw it posted a one-line manual patch in its forum, as-is with no warranty. - [Gantry and Joomla 3](https://joomla3security.com/vendors/gantry/): Dropped Joomla 3.x support in Gantry 5.5.20, announced in July 2025 for release on 23 July. - [HikaShop and Joomla 3](https://joomla3security.com/vendors/hikashop/): Has published nothing about Joomla 3, but still offers its current release to Joomla 3 sites through its update feed, and its download page lists Joomla 3.x. - [iCagenda and Joomla 3](https://joomla3security.com/vendors/icagenda/): Its roadmap says the 3.9 series is the last to support Joomla 3, yet its changelog lists 3.9.15 and 3.9.16 in 2026, both labelled "Security Release Joomla 3". - [J2Commerce and Joomla 3](https://joomla3security.com/vendors/j2commerce/): Set 19 October 2026 as the end of life for J2Store 3, with no further releases of any kind after it. Until then the Joomla 3 line has received every security fix the same day as J2Store 4. - [JCE and Joomla 3](https://joomla3security.com/vendors/jce/): Said in February 2026 that JCE 3.0 would remove official Joomla 3 support, then lowered the 2.9.99 Joomla 3 floor to 3.9, published a free security patch reaching back to 2.7.x, and was still releasing the 2.9.99 line for Joomla 3 in September 2026. - [JEvents and Joomla 3](https://joomla3security.com/vendors/jevents/): Names JEvents 3.6.82 as the last planned release for Joomla 3.10.x on its download page, and warns against installing anything later on Joomla 3. The page is undated. - [JoomDonation and Joomla 3](https://joomla3security.com/vendors/joomdonation/): Announces "Discontinued Joomla 3 Support" for OS Property on a page that also lists it as compatible with Joomla 3.9.0+, and shipped Events Booking 4.9.5 for Joomla 3 in July 2026 with security fixes, available only by updater or support ticket. - [Joomlapolis and Joomla 3](https://joomla3security.com/vendors/joomlapolis/): Ended Joomla 3.x support for Community Builder on 21 August 2026, three years after Joomla 3 reached end of life, with new releases that remove Joomla 3.x support entirely. - [Joomlashack and Joomla 3](https://joomla3security.com/vendors/joomlashack/): Pledged in August 2023 to support Joomla 3 extensions until at least August 2024 and reassess then. The pledge is still on its documentation page, the reassessment was never published, and Joomla 3-only products get no bug fixes. - [Joomlatools and Joomla 3](https://joomla3security.com/vendors/joomlatools/): Released DOCman 6 in October 2025 as one build that works across all Joomla versions, and told Joomla 3, 4 and 5 sites they can upgrade when they are ready. - [JoomlaWorks and Joomla 3](https://joomla3security.com/vendors/joomlaworks/): Said in May 2024 it would not give up on K2 or Joomla 3, and in April 2026 released its own maintained Joomla 3 distribution, Joomla 3.x UTD, which is not an official Joomla release. - [JoomShaper and Joomla 3](https://joomla3security.com/vendors/joomshaper/): Announced on 9 July 2026 that Joomla 3 would get no security patches regardless of severity, then shipped Joomla 3 security packages for Helix Ultimate, Helix3 and SP Page Builder six days later and kept patching through September. - [Kunena and Joomla 3](https://joomla3security.com/vendors/kunena/): Called Kunena 5.2.14, released in December 2022, the final release for Joomla 3.10. That was eight months before Joomla 3 itself reached end of life. - [Mosets and Joomla 3](https://joomla3security.com/vendors/mosets/): Made Mosets Tree 4.0 Joomla 4 only in August 2021, two years before Joomla 3 reached end of life. - [Phoca and Joomla 3](https://joomla3security.com/vendors/phoca/): Has published nothing about Joomla 3. Phoca Cart 3.5.8, from October 2021, is still the newest release offered to Joomla 3 sites, and the 2026 Phoca Cart security releases have no Joomla 3 version. - [Regular Labs and Joomla 3](https://joomla3security.com/vendors/regular-labs/): Shipped its last Joomla 3 builds on 4 September 2023 and removed Joomla 3 support across the range that month. The Joomla 3 branches are frozen there, so the 2026 security fixes have no Joomla 3 version. - [RocketTheme and Joomla 3](https://joomla3security.com/vendors/rockettheme/): Closed on 30 June 2025 after twenty years. The club, member downloads and support forum closed with it, so RocketTheme templates on Joomla 3 sites have no vendor at all. - [SEBLOD and Joomla 3](https://joomla3security.com/vendors/seblod/): Told Joomla 3 sites in May 2023 to stay on SEBLOD 3, and has said nothing since. SEBLOD 3.30.0 shipped in July 2026 with security fixes, including the unauthenticated path traversal. - [Sigsiu and Joomla 3](https://joomla3security.com/vendors/sigsiu/): Said in May 2024 that the SobiPro 2.5 series would be the last made for Joomla 3 and PHP 7.4. - [Solidres and Joomla 3](https://joomla3security.com/vendors/solidres/): Dropped Joomla 3 support in Solidres 2.13.0 in December 2022, eight months before Joomla 3 reached end of life. - [StackIdeas and Joomla 3](https://joomla3security.com/vendors/stackideas/): We found no public statement about Joomla 3 support for its extensions. - [Tassos and Joomla 3](https://joomla3security.com/vendors/tassos/): Points Joomla 3 sites to a legacy release built for Joomla 3.x, and still patches that branch: Convert Forms 4.4.16 and 4.4.17 shipped security fixes for Joomla 3 in July and August 2026. - [VirtueMart and Joomla 3](https://joomla3security.com/vendors/virtuemart/): Still describes VirtueMart 4 as compatible with Joomla 3.10.x on its download page, with no end date published. - [Weeblr and Joomla 3](https://joomla3security.com/vendors/weeblr/): Discontinued sh404SEF in July 2023 and said no further development would be dedicated to Joomla 3 support for its successors, 4SEF and 4SEO. - [YOOtheme and Joomla 3](https://joomla3security.com/vendors/yootheme/): Removed Joomla 3 and 4 support in YOOtheme Pro 5.0 in January 2026, yet keeps a 4.5.x line for Joomla 3 that received all four 2026 security fixes in August. The ZOO installation page still lists Joomla 3.x as a requirement. ## Publisher - [mySites.guru](https://mysites.guru/llms.txt): the Joomla and WordPress management service that publishes this site.