High severity · published Aug 21, 2026
CVE-2026-76612
Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66
8.6
CVSS
0.4%
EPSS
No
On KEV
Description
Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZE
Zoo extension for Joomla · yootheme.com
1.0.0-4.1.65 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76612
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76612
www.yootheme.com
https://www.yootheme.com/
More from Zoo extension for Joomla
10.0
CVE-2026-74803
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64
9.3
CVE-2026-74804
Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64
6.9
CVE-2026-76611
Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66
6.9
CVE-2026-76610
Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65
5.3
CVE-2026-77028
Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66