Skip to content
OpenAdvisories

Vendor

yootheme.com

13 known vulnerabilities.

Products

Zoo extension for Joomla 8 YOOtheme Pro extension for Joomla 5
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.1
    CVE-2026-77997

    Joomla Extension - yootheme.com - Authenticated, privileged information disclosure about site modules YOOtheme Pro 1.0.0-5.0.40

    Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with com_template editing permissions to access information about arbitrary modules without the respective c…

    yootheme.com YOOtheme Pro extension for Joomla Web / CMS
  • Medium 6.9
    CVE-2026-76611

    Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66

    Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.

    yootheme.com Zoo extension for Joomla Web / CMS
  • Medium 5.3
    CVE-2026-77028

    Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66

    Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66

    yootheme.com Zoo extension for Joomla Web / CMS
  • Medium 4.6
    CVE-2026-77029

    Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66

    Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66

    yootheme.com Zoo extension for Joomla Web / CMS
  • Medium 6.9
    CVE-2026-76610

    Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65

    Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users.

    yootheme.com Zoo extension for Joomla Web / CMS
  • Medium 5.1
    CVE-2026-75114

    Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64

    Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight to setRedirect() with no validation.

    yootheme.com Zoo extension for Joomla Web / CMS