PT-2026-81293 · Yootheme · Yootheme Pro
CVE-2026-77996
·
Published
2026-08-25
·
Updated
2026-08-25
CVSS v4.0
7.5
High
| Vector | AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/S:N/AU:N |
Name of the Vulnerable Software and Affected Versions
YOOtheme Pro versions 1.0.0 through 5.0.41
Description
An authenticated and privileged stored Cross-Site Scripting (XSS) issue exists due to a lack of escaping in the location custom field. This allows an attacker with sufficient privileges to inject malicious scripts that are stored and subsequently executed in the browser of other users.
Recommendations
Update YOOtheme Pro to a version later than 5.0.41.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Yootheme Pro