CVE-2026-77028 PUBLISHED

Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66

Assigner: Joomla
Reserved: 20.08.2026 Published: 21.08.2026 Updated: 21.08.2026

Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS Score: 5.3

Product Status

Vendor yootheme.com
Product Zoo extension for Joomla
Versions Default: unaffected
  • Version 1.0.0-4.1.65 is affected

Credits

  • Phil Taylor, mysites.guru finder

References

Problem Types

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE
  • CWE-601 URL Redirection to Untrusted Site ('Open Redirect') CWE