Hi,

After updating to JCE Pro 2.9.99.6 the editor toolbar no longer renders. In the article edit screen the editing/content area works normally and is fully editable, but the toolbar (buttons) is completely missing — it collapses to a thin empty line where the button row should be. This started immediately after the update to 2.9.99.6.

Environment
- Joomla 5.4.6
- JCE Pro 2.9.99.6
- Admin template: Atum (default)
- Browser: Chrome (latest)
- JCE set as default editor for all profiles

What I have already checked / ruled out
- Uninstalled and reinstalled JCE Pro — no change.
- Disabled and re-enabled JCE in configuration — no change.
- Other editors (TinyMCE / CodeMirror) load correctly with their toolbars, so the issue is specific to JCE.
- Compress Javascript and Compress CSS are both set to No.
- Changed the Toolbar Theme in the profile — no change.
- Console: no fatal JavaScript errors. Only an accessibility warning (label "for" mismatch) and a deprecation notice for unload event listeners in tinymce.js — nothing that blocks execution.
- Network tab: every JCE asset returns HTTP 200 — tinymce.js, editor.min.js, theme.js, the three plugin.js files, content.css, anchor.svg and the wfeditor.woff font all load successfully. Nothing is blocked (no 403) and nothing is missing (no 404).
- DOM inspection: the toolbar container (#jform_articletext_toolbar / div.mceToolbar.mceLeft) is present in the DOM but contains no buttons. The iframe content area (#jform_articletext_ifr) renders correctly once a window resize occurs.

So all scripts and styles load with 200, there are no console errors, yet the toolbar buttons are never built. This points to an initialization regression in 2.9.99.6 rather than an asset, cache, server or configuration issue on my side. The site body uses display:flex, which I know has interacted with JCE init in the past, in case that is relevant.

I would like to downgrade to 2.9.99.5 as a temporary measure while this is investigated, but I am unable to: the Downloads area and my account both list two identical 2.9.99.6 entries, with no 2.9.99.5 available. This looks like a packaging error — one of the two entries was likely meant to be 2.9.99.5. Could you either restore access to 2.9.99.5 or advise on a fix?

Happy to provide backend access or any further details. Thank you.

Thanks — you were right, this was the attack, not an editor bug. I found seven rogue editor profiles with auto-generated names (J######), one of which had files=php in its Permitted File Extensions and an ordering of -99999 so it sat at the top and overrode my Default profile — that's why the toolbar was missing. Deleting the rogue profiles brought all the buttons back immediately.

I've kept a copy of the malicious import file as evidence, I'm already on 2.9.99.6, and I'm now working through the cleanup: checking server access logs and scanning for any uploaded files, and rotating all passwords (admin, database, FTP, hosting). Thanks for pointing me to the advisory.

Hello, could you tell me where do you find malicious files ? Thanks