YOOtheme Pro vulnerabilities
4 known CVE vulnerabilities in YOOtheme Pro, translated and rated.
- CVE-2026-77997Medium
YOOtheme Pro for Joomla versions 1.0.0-5.0.41 has a missing access check, allowing users with com_template editing permissions to access information about arbitrary modules without the respective com_modules permissions. This is an information disclosure for authenticated, privileged users.
- CVE-2026-77996High
Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector.
- CVE-2026-76613High
YOOtheme Pro for Joomla versions 1.0.0-5.0.40 contains an SQL injection vulnerability that allows any contributor-level user to inject own content into SQL queries.
- CVE-2026-75115High
Joomla Extension - yootheme.com - YOOtheme Pro 2.3.0-5.0.40 has authenticated, privileged arbitrary file read. The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files.