Skip to content
OpenAdvisories

Vendor

yootheme.com

13 known vulnerabilities.

Products

Zoo extension for Joomla 8 YOOtheme Pro extension for Joomla 5
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.5
    CVE-2026-77996

    Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41

    Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector.

    yootheme.com YOOtheme Pro extension for Joomla Web / CMS
  • High 8.6
    CVE-2026-76612

    Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66

    Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.

    yootheme.com Zoo extension for Joomla Web / CMS
  • High 7.0
    CVE-2026-75115

    Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40

    Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files.

    yootheme.com YOOtheme Pro extension for Joomla Web / CMS
  • High 8.6
    CVE-2026-76613

    Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40

    Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries.

    yootheme.com YOOtheme Pro extension for Joomla Web / CMS