CVE-2026-76612: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in yootheme.com Zoo extension for Joomla

The vulnerability CVE-2026-76612 in the yootheme.com Zoo extension for Joomla (versions <=4.1.65) is an improper neutralization of input during web page generation (CWE-79). Specifically, user input in comments and user-supplied fields was not escaped, enabling unauthenticated stored cross-site scripting attacks. This allows attackers to inject malicious scripts that execute in the context of users viewing the affected pages. The CVSS 4.0 score is 8.6 (high), indicating network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity.

Successful exploitation can lead to execution of arbitrary scripts in the context of users visiting the affected Joomla site, potentially resulting in session hijacking, defacement, or other malicious actions impacting confidentiality and integrity of user data. The vulnerability is exploitable without authentication but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Users should monitor yootheme.com and Joomla advisories for updates addressing this vulnerability. Until a patch is available, consider disabling or restricting use of affected input fields if feasible.