Read the docs

yootheme.com

Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

yootheme.com records in CISA KEV

No yootheme.com vulnerabilities are listed in CISA KEV.

Records

13 records

TI-2026-79272 CVE-2026-102785 · GHSA-8w8j-f6ph-29mm

Unrestricted upload in YOOtheme Pro for Joomla allows code execution

Priority MEDIUM 50

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and th…

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00772 Published 2026-10-22 No fix listed CWE-434
TI-2026-52567 CVE-2026-74803 · GHSA-c2jh-c375-pjcv

Unrestricted file upload in yootheme.com Zoo extension for Joomla

Priority MEDIUM 49

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00428 Published 2026-08-19 No fix listed CWE-434
TI-2026-52568 CVE-2026-74804 · GHSA-v9gw-jh22-6wqh

Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64

Priority MEDIUM 48

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00386 Published 2026-08-19 No fix listed CWE-89
TI-2026-53544 CVE-2026-76612 · GHSA-6f22-4hxh-xrqh

Cross-site scripting in yootheme.com Zoo extension for Joomla

Priority MEDIUM 40

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00436 Published 2026-08-21 No fix listed CWE-79
TI-2026-53545 CVE-2026-76613 · GHSA-vmfm-wc5f-55m2

SQL injection in yootheme.com YOOtheme Pro extension for Joomla

Priority LOW 39

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00369 Published 2026-08-21 No fix listed CWE-89
TI-2026-53543 CVE-2026-76611 · GHSA-j32c-fpr2-v6gm

Path traversal in yootheme.com Zoo extension for Joomla

Priority LOW 37

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00496 Published 2026-08-21 No fix listed CWE-22
TI-2026-53542 CVE-2026-76610 · GHSA-5qx9-5vj6-wf25

Improper access control in yootheme.com Zoo extension for Joomla

Priority LOW 36

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00221 Published 2026-08-20 No fix listed CWE-284
TI-2026-54271 CVE-2026-77996 · GHSA-px6v-5f2p-p6xr

Cross-site scripting in yootheme.com YOOtheme Pro extension for Joomla

Priority LOW 35

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00418 Published 2026-08-25 No fix listed CWE-79
TI-2026-52777 CVE-2026-75115 · GHSA-42xr-8p7f-gqh6

Path traversal in yootheme.com YOOtheme Pro extension for Joomla

Priority LOW 31

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to…

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.00468 Published 2026-08-21 No fix listed CWE-22
TI-2026-54272 CVE-2026-77997 · GHSA-84hx-8vrm-hqm7

Improper access control in yootheme.com YOOtheme Pro extension for Joomla

Priority LOW 23

Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with com_template editing permissions to access information about arb…

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00388 Published 2026-08-25 No fix listed CWE-284
TI-2026-52776 CVE-2026-75114 · GHSA-5w5r-gpcr-x5pw

Open redirect in yootheme.com Zoo extension for Joomla

Priority LOW 23

Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight to setRedirect() with no validation.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00406 Published 2026-08-19 No fix listed CWE-601
Open these records in search →