CVE-2026-76613
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
YOOtheme Pro for Joomla versions 1.0.0-5.0.40 contains an SQL injection vulnerability that allows any contributor-level user to inject own content into SQL queries.
Risk Assessment
A user with low privileges can manipulate SQL queries, potentially leading to unauthorized data access or modification.
Recommendation
Upgrade YOOtheme Pro to a version newer than 5.0.40.
Other vulnerabilities in YOOtheme Pro
See all- CVE-2026-77997Medium
YOOtheme Pro for Joomla versions 1.0.0-5.0.41 has a missing access check, allowing users with com_template editing permissions to access information about arbitrary modules without the respective com_modules permissions. This is an information disclosure for authenticated, privileged users.
- CVE-2026-77996High
Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector.
- CVE-2026-75115High
Joomla Extension - yootheme.com - YOOtheme Pro 2.3.0-5.0.40 has authenticated, privileged arbitrary file read. The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files.
Original NVD description (English source)
Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS