CVE-2026-77996 yootheme.com CVE debrief

Who should care

Defenders responsible for Joomla installations using YOOtheme Pro should assess exposure and prioritize patching or mitigation. This includes administrators, security teams, and IT personnel managing Joomla sites with YOOtheme Pro extensions. They should verify exposure, apply patches, and monitor for potential exploitation attempts.

Why it matters

CVE-2026-77996 is a high-severity stored XSS vulnerability in YOOtheme Pro for Joomla. Defenders should verify exposure, prioritize patching, and monitor for exploitation attempts. The vulnerability's impact is limited to authenticated, privileged users, but could still lead to significant disruption and content injection.

• Potential for attacker-controlled content injection
• Possible disruption of Joomla site functionality
• Risk of user session compromise
• Need for verification of exposure and patch application

Technical summary

The vulnerability is caused by a lack of escaping in the location custom field of YOOtheme Pro, a Joomla extension, leading to a stored XSS vector. This affects versions 1.0.0-5.0.41 and has a CVSS score of 7.5. The vulnerability is limited to authenticated, privileged users but could still lead to significant disruption and content injection. Defenders should prioritize verifying exposure of Joomla installations using YOOtheme Pro and apply patches or mitigations as available.

Defensive priority

Defenders should prioritize verifying exposure of Joomla installations using YOOtheme Pro and apply patches or mitigations as available.

Recommended defensive actions

• Verify Joomla installations for YOOtheme Pro usage and assess exposure
• Apply patches or mitigations as available from the vendor
• Monitor for potential exploitation attempts

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.5 and CWE-79 classification. Evidence is limited to public CVE and NVD information. Defenders should verify exposure using official channels and apply patches or mitigations as available. The vulnerability affects YOOtheme Pro versions 1.0.0-5.0.41.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.