EUVD-2026-65477
GHSA-px6v-5f2p-p6xr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:X/U:X
PR:H reflects the mandatory privileged Joomla account; UI:R captures the victim's required page visit; S:C reflects browser-context scope change; C/I:L as impact is constrained to session/page-level without guaranteed full-system compromise.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector.
AnalysisAI
Stored cross-site scripting in YOOtheme Pro Extension for Joomla versions 1.0.0 through 5.0.41 allows authenticated, privileged users to inject persistent malicious scripts via the location custom field, which lacks HTML output escaping before rendering user-supplied content in the browser. Any site visitor who subsequently loads a page rendering the tainted field will execute the attacker-controlled script in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Joomla session with sufficient privileges to edit YOOtheme Pro custom fields - specifically administrator or editor role - as confirmed by the PR:H metric in the provided CVSS 4.0 vector and the CVE description's explicit 'authenticated, privileged' qualifier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N, score 7.5) reflects a network-reachable vulnerability with low attack complexity but a high privilege prerequisite and an attack target condition (AT:P) that tempers broad exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A threat actor who has obtained or already holds a privileged Joomla account - through credential stuffing, phishing, or insider access - navigates to the YOOtheme Pro custom field editor and injects a JavaScript payload into the location field, which is saved to the database. When any authenticated user or site visitor subsequently loads a page that renders that field, the script executes silently in their browser, exfiltrating their session cookie to an attacker-controlled endpoint and enabling full account takeover without further interaction. … |
| Remediation | Upgrade YOOtheme Pro Extension for Joomla to a version released after 5.0.41 once the vendor confirms a patched release via https://www.yootheme.com/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: verify YOOtheme Pro deployment in Joomla environments and restrict location custom field editor permissions to essential administrators only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in YOOtheme Pro for Joomla (versions 1.0.0-5.0.40) allows any authenticated contributor-level user to embe
Arbitrary file read in YOOtheme Pro (Joomla extension) versions 2.3.0 through 5.0.40 allows privileged authenticated use
Privileged information disclosure in YOOtheme Pro for Joomla (versions 1.0.0 through 5.0.41) allows authenticated users
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today