Medium severity · published Aug 19, 2026
CVE-2026-75114
Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64
5.1
CVSS
0.4%
EPSS
No
On KEV
Description
Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight to setRedirect() with no validation.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZE
Zoo extension for Joomla · yootheme.com
1.0.0-4.1.63 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-75114
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-75114
www.yootheme.com
https://www.yootheme.com/
More from Zoo extension for Joomla
10.0
CVE-2026-74803
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64
9.3
CVE-2026-74804
Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64
8.6
CVE-2026-76612
Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66
6.9
CVE-2026-76611
Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66
6.9
CVE-2026-76610
Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65