CVE-2026-77028
Received Received - Intake

Reflected XSS and Open Redirect in YOOtheme Zoo Extension

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: Joomla! Project

Description
Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-77028
EUVD
EUVD-2026-63936

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yootheme zoo to 4.1.66 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a reflected Cross-Site Scripting (XSS) and open redirect issue in the Joomla extension Zoo from yootheme.com. It affects versions prior to 4.1.66 and is triggered via the submission redirect parameter.

Impact Analysis

An attacker could exploit this to execute malicious scripts in a user's browser or redirect them to a malicious site. This could lead to session hijacking, data theft, or phishing attacks if a user clicks a crafted link.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, potentially violating GDPR (data protection) or HIPAA (healthcare data privacy) if exploited. Compliance may be impacted if user data is compromised.

Mitigation Strategies

Update the Joomla Zoo extension to version 4.1.66 or later to address the reflected XSS and open redirect vulnerabilities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77028. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart