CVE-2026-76612 is a stored XSS vulnerability in the yootheme.com Zoo extension for Joomla. Versions from 1.0.0 up to and including 4.1.65 are affected. The vulnerability arises because user input in comments and user-supplied fields is not properly escaped during web page generation, allowing attackers to inject malicious scripts that are stored and executed in the context of other users' browsers. The vulnerability is unauthenticated and has a CVSS 4.0 base score of 8.6, indicating high severity.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of users viewing affected pages. This can lead to theft of sensitive information such as cookies or credentials, session hijacking, or other malicious actions performed on behalf of the victim user. The vulnerability affects confidentiality and integrity with high impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or restricting use of affected user input fields or applying web application firewall (WAF) rules to detect and block malicious input. Monitor official yootheme.com communications for updates on patches or official fixes.