Balbooa Forms

Balbooa Forms is a web-forms extension for the Joomla content-management system, letting site operators build contact forms, surveys and other input forms without custom coding. Like other Joomla ADD-ONS, it integrates directly with the core CMS, meaning a vulnerability in the extension can be used to compromise the wider site.

A KEV-listed vulnerability in Balbooa Forms was added to CISA's Known Exploited Vulnerabilities catalogue on 10 July 2026, one of four Joomla-ecosystem extensions affected in the same fortnight alongside JoomShaper SP Page Builder, iCagenda and a Widget Factory package. That cluster, rather than any single enterprise vendor, defined this KEV window, with only Adobe ColdFusion standing out as a widely deployed enterprise product among the additions.