Jan - Feb 2026 Product Updates

We are sharing our Jan to Feb recap, with fresh updates across our Joomla extensions.

This cycle includes one very important security fix across our Joomla products, new quality-of-life features in Convert Forms, useful schema improvements in Google Structured Data, and compatibility and media upgrades in Advanced Custom Fields. We also have a quick preview of what we are building next, plus a few team milestones we are proud of.

Security Vulnerability Assessment

On January 7th, 2026, independent security researcher p1r0x, working with SSD Secure Disclosure, responsibly reported a vulnerability in the Tassos Framework system plugin, which is included in our Joomla extensions. After receiving the report, we immediately carried out a full internal code review, added extra validation and hardening measures, and released patched versions of all affected extensions.

The issue was rooted in how the plugin handled specific AJAX requests through Joomla's com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restrictions, which, in a worst-case scenario, could have allowed an unauthenticated user to read files accessible to the web server, delete files under specific conditions, and manipulate database queries to extract data.

In combination, these capabilities could potentially have been used to escalate access and execute unauthorized code. There is currently no evidence that this vulnerability has been exploited in the wild, but because the framework ships with multiple Joomla extensions, we strongly recommend updating all affected extensions to their latest release as soon as possible.

Read the full announcement: Security Update: Tassos Framework Patch Released 

Convert Forms

File Upload Previews

When a contact form asks users to upload files, they want to quickly confirm they picked the right ones before submitting. Until now, uploads have appeared without visual feedback, making it harder to tell whether the selected file is correct, especially with images or multiple attachments.

We added a new Layout option in the File Upload field with 2 choices: List (the existing view) and Thumbnails (the new view). Thumbnails show image previews and icons for popular file types such as PDF and ZIP, making uploads easier to verify at a glance.

That gives users instant visual confirmation of what they uploaded, without guesswork.

Copy Associated Tasks When Duplicating & Exporting Forms

Teams that rely on Form Tasks for email notifications or internal workflows need those automations to move with the form itself. Until now, copying or transferring a form between Joomla sites could leave behind associated tasks, which meant extra manual setup and a higher risk of missing important automation steps.

Forms can now be duplicated and exported without losing task automation. Associated tasks are included in duplication and export/import flows, so forms and their logic travel together.

New {form.id} and {form.name} Smart Tags

When multiple forms send emails to the same administrator inbox, messages can start to look almost identical. That makes it harder to determine which form triggered the notification, especially on sites that use shared email templates or collect submissions from multiple contact points.

The latest release of Convert Forms introduces 2 form-based Smart Tags. {form.id} and {form.name} - You can use them in notifications, so recipients can instantly see which form triggered each email. Here's an example HTML email to the administrator:

Improved Submissions Search (Backend and Frontend)

Searching through submissions should help admins find the right entry quickly, but inconsistent results made that harder than it should be. In practice, that meant more time spent manually scanning records, especially on busy Joomla sites with large submission lists.

Finding the right submission is now much faster. We improved search behavior in both the backend and frontend lists to deliver more reliable, predictable results.

Google Structured Data

Custom Fields Support for J2Commerce

With our J2Commerce structured data integration, you can easily generate Product Schema markup for your products. However, many J2Commerce stores store important product information in custom fields, and until now, that data could not easily be included in the structured data output. As a result, store owners could generate Product Schema but still struggled to map richer product details when those values existed outside the default fields.

Now you can map schema properties directly to J2Commerce custom fields, allowing your structured data to reflect your actual product information more accurately.

Lodging Business Added to Organization Schema

Hotels, rentals, and other hospitality businesses need to describe themselves as precisely as possible in structured data. Without a lodging-specific option in the Organization schema, site owners had to rely on broader categories, giving search engines less context about the business’s actual type.

You can now select Lodging Business in the Organization schema type and publish more accurate business metadata, helping search engines better understand and represent your property.

2 Custom Code Fixes

Custom Code needs to generate clean, standards-friendly output, especially when the result is consumed by search engines. In this case, 2 formatting issues could weaken the final markup quality:

• Dates were not always output in ISO 8601 format.
• Image URLs were not always generated as full URLs.

The result is cleaner Custom Code output with proper ISO 8601 dates and full image URLs.

Advanced Custom Fields

File Upload Previews in File Upload Field

When editors upload a file in the ACF File Upload field, they need a quick way to confirm they selected the right image before saving the article or custom content. Until now, the field has given them almost no visual feedback, making image-heavy workflows slower and more prone to error.

We brought the same file-upload preview experience from the Convert Forms File Upload field to the ACF File Upload field. Uploaded images can now be previewed directly, giving editors the same kind of visual confirmation before saving their content.

Facebook Reels Support in the Video Field

Short-form video continues to grow, and content editors are increasingly using Facebook Reels alongside traditional video platforms. The problem was that ACF Video Field already supported major providers, but Reels links did not fit cleanly into that workflow, which limited embedding flexibility for teams publishing social-first content. Facebook Reels can now be embedded directly through ACF Video.

Compatibility with YooTheme 5

Many Joomla sites use ACF Custom Fields together with YooTheme in their page-building workflow, so compatibility between the 2 is critical. When YooTheme 5 entered beta, changes to the builder could affect how ACF Custom Fields behaved within YooTheme layouts, making early testing and upgrades more uncertain.

After a series of compatibility fixes, ACF now works properly with YooTheme 5, so site builders can keep using their custom field content within YooTheme layouts with greater confidence.

We Are Working on Something New

Site admins often hit the same pain points with small customizations:

• Custom code grows fast and becomes hard to track.
• Simple CSS/JS tweaks require editing template files.
• Small changes often require installing another plugin.
• Reusing the same snippet across pages is difficult.

We are building a new Joomla extension that acts as a code snippet manager. It will let site owners create, organize, and inject snippets (HTML, CSS, JS, PHP, plain text) into key locations like head, body, footer, and article positions (after title, before content, after content).

Interested in testing it early? Contact us and we will invite you for a test drive.

Sponsoring Joomla Day USA in April

This year, we are proud to support JoomlaDay USA as a Gold Sponsor. The event runs from April 29 to May 2, 2026, in Delray Beach, FL. Community events like this solve a real ecosystem problem: they keep knowledge moving between users, developers, and businesses. Sponsoring is our way of supporting and giving back to the Joomla community.

Milestones, Moves & More

• We have surpassed 2.1 million downloads across all our Joomla extensions.
• Convert Forms currently has 966 reviews in the Joomla Extensions Directory and is heading toward the 1000-review milestone. Help us get there by leaving a review.
• In January, we announced that the automatic renewal discount had changed from 40% to 30%.
• We are on Trustpilot. Your feedback helps others evaluate our products, so please consider sharing your experience.
• Using WordPress too? FireBox is our WordPress pop-up plugin (the counterpart of EngageBox) and covers a wide range of pop-up needs.