CVE-2026-77996: Yootheme.com Yootheme Pro Extension For Joomla

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector.

Affected products

• Yootheme.com Yootheme Pro Extension For Joomla: version 1.0.0-5.0.41 only

Published 2026-08-25. Last modified 2026-09-23.