Security patches for Joomla 3.10.12, after end of life
Joomla 3 reached end of life in August 2023, and the paid eLTS programme ended in February 2025. A site stuck on 3.10.12 still has vulnerabilities with a public official fix.
3.10.12 is the last free release, and it has known flaws.
Between February 2024 and January 2025 the eLTS programme fixed 12 CVEs, including XSS in media fields, a content filter bypass and restricted views visible to guests. Sites left on 3.10.12 don't have them.
After eLTS, more Joomla 5 fixes cover code that still exists in Joomla 3. The eLTS fixes were published under the GPL, so they can be backported.
How we apply them.
From the official diff
Each fix starts from the code Joomla published, backported to 3.10.12 file by file.
All or nothing
The agent checks all 70 files before writing one: they must match the official 3.10.12 files, or already be fixed.
Checked on every sync
On every sync we check that the fixes are still there. If a core reinstall removes them, we put them back.
Want to try it on a real site? The 30-day trial needs no credit card.
Start free trialFrequently asked questions
Which CVEs are covered?
CVE-2024-21722, 21723, 21724, 21726, 21731, 26278, 26279, 27184, 27185, 40743, 40748 and 40749, plus 19 fixes released after eLTS up to Joomla 5.4.9 that also apply to Joomla 3 code.
Does the version number change?
No, the site stays 3.10.12. We don't change the version number, certificates or eLTS programme notices.
What about extensions?
Some Joomla 3 extensions without an installable fix get separate protection: see the page on Joomla 3 extensions.
Goes well with
- Active Shield: official security fixes for end-of-life CMS releasesOfficial fixes for Joomla 3.10.12, PrestaShop 1.7.8.11 and Joomla 3 extensions.
- Vulnerable Joomla 3 extensions, when the fixed release no longer installsPhoca Download 3.2.x and Sourcerer before 16.0.0 on Joomla 3.
- Joomla 3 has reached end of life: how to protect the sites still running itMonitoring, integrity and backups on Joomla 3.9 and 3.10, even with PHP 7.1.
- Joomla core file integrity checks, even without official checksumsChecksums computed from the official Full Package, for Joomla 3, 4, 5 and 6.
Try it on your clients' sites.
Connect your first sites today and see what SitePing finds on them.
- Every Complete feature except backups
- Up to 10 sites
- No credit card needed to start
- At the end you choose a plan or move to Free, and nothing is charged
Already have an account? Log in. Prefer to look at one site first? Free read-only audit.