CVE-2026-76613

YOOtheme Pro (a Joomla extension by yootheme.com) versions 1.0.0 through 5.0.40 are affected by an authenticated, privileged SQL injection vulnerability. Any user with contributor-level access can inject arbitrary content into SQL queries, resulting in high impact on the confidentiality, integrit...

PT-2026-79378

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files...

PT-2026-79381

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...

CVE-2026-74804

creationtimestamp| type| source ---|---|--- 2026-08-19 14:04:01+00:00| seen| https://bsky.app/profile/yootheme.bsky.social/post/3mtgvj2kahc2s 2026-08-19 14:04:02+00:00| seen| https://bsky.app/profile/yootheme.bsky.social/post/3mtgvj2lbns2s 2026-08-19 16:08:24+00:00| seen|...

CVE-2026-10077 YOOtheme Pro < 5.0.35 - Author+ Stored XSS via UIkit Data Attributes

The yootheme WordPress theme before 5.0.35 does not prevent its bundled front-end framework from treating certain HTML attributes, which are permitted by wpksespost, as markup, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the browser of any us...

CVE-2026-10077

The affected product is the YOOtheme WordPress theme (prior to 5.0.35). The issue arises in the bundled front-end framework that can treat certain HTML attributes, allowed by wp_kses_post(), as markup, enabling Stored XSS when a user with the Author role views a post. The root cause is improper h...