High · 7.5 CVE-2026-77996 EUVD-2026-65477GHSA-px6v-5f2p-p6xr

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41

Published Aug 25, 2026 · Updated Aug 26, 2026 · Assigned by Joomla

Vendor: yootheme.com Product: YOOtheme Pro extension for Joomla Category: Web / CMS

Description

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector.

Affected products

Vendor	Product	Affected	Fixed
yootheme.com	YOOtheme Pro extension for Joomla	1.0.0-5.0.41	—

References

https://www.yootheme.com/ product