CVE-2026-76612
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Joomla Extension - yootheme.com - Zoo prior to version 4.1.66 has unauthenticated stored XSS. User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.
Risk Assessment
An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft or other attacks.
Recommendation
Update the Zoo extension to version 4.1.66 or later.
Other vulnerabilities in Zoo
See all- CVE-2026-74804Critical
Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64. The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.
- CVE-2026-74803Critical
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64. The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.
- CVE-2026-77028Medium
The Joomla extension Zoo (from yootheme.com) before version 4.1.66 has a reflected XSS and open redirect vulnerability via the submission redirect parameter.
- CVE-2026-76611Medium
The Joomla extension Zoo (from yootheme.com) before version 4.1.66 has an unauthenticated arbitrary directory listing vulnerability via the Gallery element.
- CVE-2026-77029Medium
The Joomla extension Zoo (from yootheme.com) before version 4.1.66 has missing CSRF tokens on front-end state changes, enabling CSRF attacks.
- CVE-2026-76610Medium
In the Zoo extension for Joomla (versions < 4.1.65), the comment controller endpoint lacks ACL checks, allowing unauthenticated users to modify tags without authorization.
- CVE-2026-75114Medium
Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight to setRedirect() with no validation.
Original NVD description (English source)
Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.