YOOtheme Zoo CVE-2026-76612

The Zoo Extension for Joomla must be installed and running a version below 4.1.66. The attacker must have access to a Zoo comment submission endpoint or a user-editable field element - no authentication is required for this step (PR:N per the CVSS 4.0 vector). Payload detonation is not immediate: a victim with a meaningful session (typically an administrator or editor) must load the page containing the stored payload (UI:A). Exploitation is therefore limited by the requirement for victim interaction and by the need for the Zoo extension to be publicly accessible for unauthenticated submissions. Sites that restrict comment or field submission to authenticated users only significantly reduce the attack surface, though the underlying escaping flaw would still be present for lower-privileged authenticated users.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L) conveys a high-severity, network-reachable, low-complexity flaw with no authentication prerequisite, though active user interaction (UI:A) is required for payload detonation - an administrator or privileged user must view the poisoned page. The VC:H/VI:H ratings reflect the realistic worst case of session takeover or admin-level DOM manipulation. VA:L is appropriate; availability is a secondary concern for XSS. No EPSS score was supplied in the input data, so exploitation probability cannot be quantified numerically. The absence of a KEV listing and no reported POC suggests this is not yet under active broad exploitation, but the unauthenticated submission vector - anyone who can post a comment or fill a field plants the payload - makes weaponization straightforward once the flaw is understood. The stored nature of the XSS elevates real-world risk above reflected variants: a single malicious submission can compromise every subsequent visitor including administrators, making remediation urgency higher than the UI:A metric alone might imply.

An unauthenticated attacker submits a comment or populates a user-supplied Zoo field containing a JavaScript payload such as a cookie-stealing script. The payload is stored unescaped in the Joomla database. When a site administrator reviews submissions or visits the affected content page, the script executes in their privileged browser session, exfiltrating their session token to an attacker-controlled endpoint and enabling full administrative account takeover. No public exploit code is confirmed at time of analysis, but the attack pattern is well-understood for stored XSS and requires no specialist tooling.