Balbooa Forms Builder Pro 2.4.3.3

• POST requests being blocked by hosting providers
• Incorrect payment amount calculation
• Field IDs being displayed for empty fields in Email Notifications
• Form template installation
• Extra quotation marks being displayed when passing URL parameters through shortcodes

Improved

• Authorization, request handling, and access controls across Media Manager operations
• Path validation and safeguards for internal file and directory operations
• Payment validation to ensure transaction amounts are consistently verified during payment processing
• Parameter handling and validation in post-submission PHP scripts for more secure and reliable data processing
• Validation of signature images to ensure only valid image data is processed and stored

Fixed

• Fixed an issue with form submission when file minification is enabled in Gridbox
• Fixed the positioning of the Advanced Thank You Message

Balbooa Forms 2.4.3.1 is a proactive security hardening release that introduces additional safeguards across several internal components of the application. While this update is not related to any publicly disclosed vulnerability, we strongly recommend that all customers install it as soon as possible.

Security Update
This release addresses a security vulnerability affecting previous Forms versions

CVE: CVE-2026-56291

Security Fixes:

• Added server-side validation of allowed file extensions for frontend uploads based on the field configuration
• For the Upload File field, a new MIME Types option has been added to improve upload security
• Uploaded files now receive randomly generated server-side filenames instead of preserving client filenames
• Added CSRF protection to frontend file upload requests

Affected Versions: 2.4.0 and earlier

Action Required: Update to Forms 2.4.1 immediately

Acknowledgement: Vulnerability was responsibly disclosed by Phil E. Taylor

Added

• Joomla 6 Compatibility

Fixed

• Issue with a Signature field on hidden pages
• Issues with a text editor in the admin panel

v2.3.1.3​

Fixed

• Aria Label for checkbox, radio, poll and acceptance fields

v2.3.1.2​

Added

• Font Awesome 6 icon library
• Aria Label for the Acceptance field
• Full compatibility with Joomla update system

Fixed

• Cross-Site Scripting (XSS) web security vulnerability
• Fiscalization for payment gateway Cloudpayments

Added

• Accessible Design Option
• Aria Label for Submit button field
• Ability to navigate the form using a keyboard
• Full compatibility with the default Joomla plugin "Additional Accessibility Features"
• Built-in Google reCAPTCHA integration
• Fiscalization for payment gateways: Cloudpayments, Robokassa, and YooKassa
• Ability to set the time for the Submit Expiration Date

Fixed

• Issue related to form submitting limitation by IP address
• Small design issues in the admin panel

- not known

no change log for this version

Added

• Native compatibility with Joomla 5
• Undo or redo changes in the form editor
• Submission limitations
• Cloudflare Turnstile integration
• Google Sheets integration
• Google Drive integration

Updated

• Telegram integration

Fixed

• Issues with the code editor
• Issues with CLI commands
• Issues with complex conditional logic rules and PayPal integration.
• Creating PDF files in PHP 8.x
• CSS issue with calendar z-index
• CSS issue with displaying help text on mobile devices
• CSS issue with form templates in the editor
• Design styles for field calculation
• Issues with the settings panel in sidebar mode
• Issues with dark mode in Joomla 5