# CVE-2026-77028: YOOtheme Zoo reflected XSS and open redirect in submission redirect parameter

Source: https://junglewise.ai/threats/cve-2026-77028-yootheme-zoo-reflected-xss-and-open-redirect-in-submission  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77028 · Severity: info · Published 2026-08-21

YOOtheme Zoo is a content management extension for Joomla used to organize and display structured content. This vulnerability allows attackers to inject malicious scripts into web pages viewed by users (reflected XSS) or redirect users to attacker-controlled websites through improper handling of the submission redirect parameter, potentially leading to credential theft or phishing attacks.

Technologies: [YOOtheme Zoo](https://junglewise.ai/threats/technologies/zoo). Vendors: [YOOtheme](https://junglewise.ai/threats/vendors/yootheme).

## Quick answers

**Is CVE-2026-77028 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77028 being exploited in the wild.

**How severe is CVE-2026-77028?** Informational severity, published 21 August 2026.

**Which products and versions are affected?** YOOtheme Zoo < 4.1.66.

**Is there a fix for CVE-2026-77028?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77028 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77028?** Check whether you run YOOtheme Zoo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a combined reflected cross-site scripting (XSS) and open redirect flaw in YOOtheme Zoo versions prior to 4.1.66. The vulnerable component is the submission redirect parameter, which fails to properly validate or sanitize user input before reflecting it back in HTTP responses or using it for redirects. An attacker can craft a malicious URL containing JavaScript payload or a redirect target and trick users into clicking it. Exploitation does not require authentication or special privileges. The impact includes session hijacking through reflected XSS and user redirection to phishing or malware sites via the open redirect.

## Affected products

- YOOtheme Zoo < 4.1.66

## Timeline

- 2026-08-21: disclosed

## References

- [https://www.yootheme.com/](https://www.yootheme.com/)

## Related threats

- [YOOtheme Zoo stored XSS in comments and user fields](https://junglewise.ai/threats/cve-2026-76612-yootheme-zoo-stored-xss-in-comments-and-user-fields)
- [YOOtheme Zoo arbitrary directory listing via Gallery element](https://junglewise.ai/threats/cve-2026-76611-yootheme-zoo-arbitrary-directory-listing-via-gallery-element)
- [YOOtheme Zoo CSRF vulnerability in front-end state changes](https://junglewise.ai/threats/cve-2026-77029-yootheme-zoo-csrf-vulnerability-in-front-end-state-changes)
- [YOOtheme Zoo unauthenticated tag modification via missing ACL checks](https://junglewise.ai/threats/cve-2026-76610-yootheme-zoo-unauthenticated-tag-modification-via-missing-acl)