Yootheme.com

9 CVEs across 2 Yootheme.com products. Browse Yootheme.com vulnerabilities, severities, and proof-of-concept exploits.

Yootheme.com products with known CVEs

ProductCVEs
Zoo Extension For Joomla6
Yootheme Pro Extension For Joomla3
Yootheme.com CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-779972026-08-25Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with com…
CVE-2026-779962026-08-25Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a X…
CVE-2026-770282026-08-21Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66
CVE-2026-766132026-08-21Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to…
CVE-2026-766122026-08-21Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied fie…
CVE-2026-766112026-08-21Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.
CVE-2026-770292026-08-21Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66
CVE-2026-766102026-08-20Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized…
CVE-2026-748032026-08-19Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Co…