Details

Created: 08 June 2026

Following on from last week's emergency update, I have spent the last 4 days conducting a comprehensive analysis and audit of the JCE extension, narrowing entry points, and hardening input validation.

This release is the result of that audit. It is a strongly recommended update for all sites.

I hope that this update and those to follow will go some way to retaining and reinforcing your trust and confidence in JCE.

Update fatigue is real. If you manage multiple sites you might consider services like BackupMonkey and MySites.guru, which assist in managing and updating multiple sites.

Please Note: JCE Pro 2.9.99.x is compatible with Joomla 3, 4, 5 and 6, and does not require the Backwards Compatibility plugin in Joomla 5 or Joomla 6.

Details

Created: 03 June 2026

This is a critical security release. All JCE Pro users should update immediately.

A vulnerability has been identified that allowed unauthenticated users to upload editor profiles, which could be exploited to upload arbitrary files to the server. The issue has been fixed in this release.

Affected versions: All versions of JCE prior to 2.9.99.5.

Action required: Update to 2.9.99.5 via the Joomla Updater or by downloading directly from the downloads area. No configuration changes are required.

If you are unable to update, please uninstall JCE.

Thanks to David Jardin for his assistance and to Uwe Flottemesch at fc-hosting.de for reporting the issue.

Please Note: JCE Pro 2.9.99.x is compatible with Joomla 3, 4, 5 and 6, and does not require the Backwards Compatibility plugin in Joomla 5 or Joomla 6.

Details

Created: 28 May 2026

This is a security maintenance release and all users are encouraged to update as soon as possible.

Two related vulnerabilities have been identified and resolved in JCE Core and JCE Pro. All previous versions are affected.

An authenticated user could potentially access an Editor Profile that they are not assigned to and invoke filesystem actions available to that profile, but within the restrictions of that profile. Additionally, a directory parameter could be manipulated in a filesystem search function to list folder contents outside the configured directory.

Both issues have been resolved in 2.9.99.4. Exploitation required an active, authenticated Joomla session; unauthenticated access was not possible.

We were made aware of this issue via an external security report and completed our investigation and fix within 24 hours. We would like to thank the reporter for submitting their findings in good faith.

All JCE users should update to 2.9.99.4 at the earliest opportunity via the Joomla Update Manager or the JCE downloads area.

Please Note: JCE Pro 2.9.99 is compatible with Joomla 3, 4, 5 and 6, and does not require the Backwards Compatibility plugin in Joomla 5 or Joomla 6.

Details

Created: 20 May 2026

JCE Pro 2.9.99.3 is a maintenance update addressing a number of issues, including improvements to anchor selection and link boundary highlighting when aplpying Styles to links, several table fixes relating to cell merging, audio option handling in the Media Manager, and improved image thumbnail loading in the Image Manager Extended and File Browser.

Please note: when using Joomla 4, JCE Pro requires Joomla 4.2 or later and will not install on Joomla 4.0 or 4.1

As previously announced, this remains the final feature release in the 2.x series - JCE Pro 3.0 is on its way, with the a beta available for testing.

Please Note: JCE Pro 2.9.99 is compatible with Joomla 3, 4, 5 and 6, and does not require the Backwards Compatibility plugin in Joomla 5 or Joomla 6.

Details

Created: 22 April 2026

JCE Pro 2.9.99.2 is a supplemental maintenance update to 2.9.99, addressing a number of issues reported since its release - including fixes for link editing, editor height in Joomla 6.1, smart quote shortcuts, and Word paste behaviour, along with an improvement to the Media Field for sites with multiple configured directory stores.

As previously announced, this remains the final feature release in the 2.x series - JCE Pro 3.0 is on its way, with the a beta available for testing.

Please Note: JCE Pro 2.9.99 is compatible with Joomla 3, 4, 5 and 6, and does not require the Backwards Compatibility plugin in Joomla 5 or Joomla 6.

Read more: JCE Pro 2.9.99.2 released