YOOtheme Pro EUVD-2026-65477

Exploitation requires an authenticated Joomla session with sufficient privileges to edit YOOtheme Pro custom fields - specifically administrator or editor role - as confirmed by the PR:H metric in the provided CVSS 4.0 vector and the CVE description's explicit 'authenticated, privileged' qualifier. The vulnerable surface is the location custom field within YOOtheme Pro; the field must be present and rendered on at least one publicly or internally accessible page for the stored payload to reach victims. The AT:P condition in the CVSS 4.0 vector indicates that a specific attack target configuration may further be required. Exploitation is limited by: the mandatory high-privilege Joomla account (no unauthenticated path exists), the need for downstream victims to browse to a page rendering the tainted field, and the version ceiling of 5.0.41. Sites that enforce strict role separation, use unique strong credentials for admin accounts, and do not expose the Joomla admin panel to untrusted networks face substantially reduced real-world risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N, score 7.5) reflects a network-reachable vulnerability with low attack complexity but a high privilege prerequisite and an attack target condition (AT:P) that tempers broad exploitability. The PR:H requirement is the dominant risk-reduction factor: an attacker must already control a privileged Joomla account - such as an administrator or editor - before the payload can be introduced, meaning external adversaries without prior credential access pose no direct threat. VC:H and VI:H in the impact metrics are consistent with full session compromise for any victim loading the affected page, which is a realistic worst-case for stored XSS. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The absence of a CISA KEV listing and no reported POC indicate no confirmed active exploitation at time of analysis. Organizations that share privileged Joomla credentials across multiple personnel or expose the Joomla admin panel to the internet face a materially higher risk, as insider-threat or credential-stuffing scenarios could lower the effective barrier significantly. Overall, this is a moderate-to-high concern for multi-user Joomla deployments, but not an emergency for sites with tightly controlled admin access.

A threat actor who has obtained or already holds a privileged Joomla account - through credential stuffing, phishing, or insider access - navigates to the YOOtheme Pro custom field editor and injects a JavaScript payload into the location field, which is saved to the database. When any authenticated user or site visitor subsequently loads a page that renders that field, the script executes silently in their browser, exfiltrating their session cookie to an attacker-controlled endpoint and enabling full account takeover without further interaction. No public proof-of-concept code has been identified at time of analysis.