CVE-2026-77996

The YOOtheme Pro extension for Joomla versions 1.0.0 to 5.0.41 is vulnerable to an authenticated, privileged stored cross-site scripting (XSS) attack due to inadequate escaping in the location custom field. This flaw allows attackers with valid credentials to inject malicious scripts, potentially compromising user data and session integrity. Joomla administrators and web developers using this extension should prioritize applying security updates to mitigate the risk of exploitation.