CVE-2026-77996: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in yootheme.com YOOtheme Pro extension for Joomla

This vulnerability (CVE-2026-77996) in the YOOtheme Pro extension for Joomla (versions 1.0.0 to 5.0.41) is a stored cross-site scripting (CWE-79) issue caused by lack of proper escaping in the location custom field. Authenticated users with high privileges can inject malicious scripts that are stored and later executed in the context of other users, potentially compromising confidentiality and integrity. The CVSS 4.0 base score is 7.5, reflecting network attack vector, low attack complexity, and no user interaction required. The vendor has not provided an official fix or remediation level as of the publication date.

Successful exploitation allows an authenticated privileged user to inject and store malicious scripts in the location custom field, which can execute in the context of other users accessing the affected Joomla site. This can lead to unauthorized disclosure or modification of information (high confidentiality and integrity impact). Availability impact is not indicated. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to privileged accounts and monitor for suspicious activity related to the location custom field. Avoid using untrusted input in this field. No vendor-provided mitigation or temporary fix is currently documented.