Yootheme.com vulnerabilities
We track 7 vulnerabilities in Yootheme.com products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 22, 2026.
Latest Yootheme.com vulnerabilities
- 10.0 Critical severity
YOOtheme Pro extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request sign
- 7.5 High severity
YOOtheme Pro extension for Joomla: Improper Neutralization of Input During Web Page Generation
Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector.
- 8.6 High severity
YOOtheme Pro extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries.
- 8.6 High severity
Zoo extension for Joomla: Improper Neutralization of Input During Web Page Generation
Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.
- 7.0 High severity
YOOtheme Pro extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files.
- 9.3 Critical severity
Zoo extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or esc
- 10.0 Critical severity
Zoo extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.