Yootheme Pro Extension For Joomla
Monthly
Privileged information disclosure in YOOtheme Pro for Joomla (versions 1.0.0 through 5.0.41) allows authenticated users holding only com_template editing permissions to read metadata about arbitrary Joomla modules - access that normally requires the separate com_modules permission. The root cause is CWE-284 (Improper Access Control): the extension's template editor fails to verify whether the requesting user holds the appropriate module-management permission before returning module data. No public exploit identified at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects the high privilege requirement and limited confidentiality impact.
Stored cross-site scripting in YOOtheme Pro Extension for Joomla versions 1.0.0 through 5.0.41 allows authenticated, privileged users to inject persistent malicious scripts via the location custom field, which lacks HTML output escaping before rendering user-supplied content in the browser. Any site visitor who subsequently loads a page rendering the tainted field will execute the attacker-controlled script in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis, and the requirement for a high-privilege Joomla account substantially limits the threat surface.
Arbitrary file read in YOOtheme Pro (Joomla extension) versions 2.3.0 through 5.0.40 allows privileged authenticated users to access files outside the intended directory by exploiting glob-based pattern injection in the Filesystem source's path filter. The vulnerability requires high-privilege credentials on the Joomla backend, limiting the attack surface to trusted but potentially malicious insiders or compromised administrator accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 7.0 reflects the high confidentiality impact from unrestricted file reads.
SQL injection in YOOtheme Pro for Joomla (versions 1.0.0-5.0.40) allows any authenticated contributor-level user to embed arbitrary SQL content into backend queries, potentially exposing or corrupting the entire Joomla site database including user credentials and content. The vulnerability spans the full release history of the extension through 5.0.40 and is particularly dangerous in multi-author or open-registration Joomla deployments where untrusted users hold contributor roles. No public exploit code has been identified at time of analysis, and CISA SSVC confirms current exploitation status as none, though SSVC also rates the technical impact as total if exploitation occurs.
Privileged information disclosure in YOOtheme Pro for Joomla (versions 1.0.0 through 5.0.41) allows authenticated users holding only com_template editing permissions to read metadata about arbitrary Joomla modules - access that normally requires the separate com_modules permission. The root cause is CWE-284 (Improper Access Control): the extension's template editor fails to verify whether the requesting user holds the appropriate module-management permission before returning module data. No public exploit identified at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects the high privilege requirement and limited confidentiality impact.
Stored cross-site scripting in YOOtheme Pro Extension for Joomla versions 1.0.0 through 5.0.41 allows authenticated, privileged users to inject persistent malicious scripts via the location custom field, which lacks HTML output escaping before rendering user-supplied content in the browser. Any site visitor who subsequently loads a page rendering the tainted field will execute the attacker-controlled script in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis, and the requirement for a high-privilege Joomla account substantially limits the threat surface.
Arbitrary file read in YOOtheme Pro (Joomla extension) versions 2.3.0 through 5.0.40 allows privileged authenticated users to access files outside the intended directory by exploiting glob-based pattern injection in the Filesystem source's path filter. The vulnerability requires high-privilege credentials on the Joomla backend, limiting the attack surface to trusted but potentially malicious insiders or compromised administrator accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 7.0 reflects the high confidentiality impact from unrestricted file reads.
SQL injection in YOOtheme Pro for Joomla (versions 1.0.0-5.0.40) allows any authenticated contributor-level user to embed arbitrary SQL content into backend queries, potentially exposing or corrupting the entire Joomla site database including user credentials and content. The vulnerability spans the full release history of the extension through 5.0.40 and is particularly dangerous in multi-author or open-registration Joomla deployments where untrusted users hold contributor roles. No public exploit code has been identified at time of analysis, and CISA SSVC confirms current exploitation status as none, though SSVC also rates the technical impact as total if exploitation occurs.