Reflected XSS and Open Redirect Vulnerability in Zoo by Yootheme
CVE-2026-77028

5.3MEDIUM

Key Information:

Vendor

Yootheme.com

Status
Zoo Extension For Joomla
Vendor
CVE Published:
21 August 2026

What is CVE-2026-77028?

The Zoo extension by Yootheme is susceptible to a reflected cross-site scripting (XSS) vulnerability and an open redirect issue. This vulnerability arises when user inputs are inadequately validated, allowing attackers to inject malicious scripts through the submission redirect parameter. When this parameter is exploited, it can lead to unauthorized access and potential data theft, jeopardizing the integrity and security of users' information.

Affected Version(s)

Zoo extension for Joomla 1.0.0-4.1.65

References

https://www.yootheme.com/
product

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phil Taylor, mysites.guru
.