EUVD-2026-63940
GHSA-6f22-4hxh-xrqh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no auth required, scope changes to victim browser enabling session theft (C:H, I:H); user must view content (UI:R); availability impact is marginal.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.
AnalysisAI
Stored cross-site scripting in Zoo Extension for Joomla (all versions before 4.1.66) allows unauthenticated remote attackers to inject persistent JavaScript payloads through comment fields and user-supplied field elements. Because these inputs were not escaped before being rendered, any user or administrator who subsequently views the affected content triggers execution of the attacker's script in their browser context, enabling session hijacking, credential theft, or privilege escalation to administrator level. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Zoo Extension for Joomla must be installed and running a version below 4.1.66. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L) conveys a high-severity, network-reachable, low-complexity flaw with no authentication prerequisite, though active user interaction (UI:A) is required for payload detonation - an administrator or privileged user must view the poisoned page. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker submits a comment or populates a user-supplied Zoo field containing a JavaScript payload such as a cookie-stealing script. The payload is stored unescaped in the Joomla database. … |
| Remediation | Upgrade Zoo Extension for Joomla to version 4.1.66 or later, which is the first patched release per the CVE description. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Joomla instances running the Zoo Extension and document their current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Zoo Extension For Joomla
View allUnauthenticated arbitrary file upload in the YOOtheme Zoo content-builder extension for Joomla (versions before 4.1.64)
SQL injection in the YOOtheme Zoo content-construction extension for Joomla allows unauthenticated remote attackers to i
Unauthenticated arbitrary directory listing in the Gallery element of the YOOtheme Zoo extension for Joomla exposes serv
Reflected XSS and open redirect in yootheme.com's Zoo extension for Joomla (versions prior to 4.1.66) allow remote attac
Open redirect in YOOtheme Zoo extension for Joomla (versions prior to 4.1.64) allows unauthenticated network attackers t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today