Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
🚨 Critical security update for ZOO We fixed 4 vulnerabilities: CVE-2026-76611: Path traversal CVE-2026-76612: Cross-site scripting CVE-2026-77028: External redirects CVE-2026-77029: CSRF attacks Update ZOO immediately to 4.1.66
Post summary
The tweet announces a critical security update for ZOO, fixing four known vulnerabilities and urging users to update immediately to version 4.1.66.
CVE-2026-76612 Unauthenticated Stored XSS in Joomla Extension Zoo < 4.1.66 via User-Controlled Fields https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-76612
Post summary
A new unauthenticated stored XSS vulnerability (CVE-2026-76612) affecting Joomla Extension Zoo versions earlier than 4.1.66 has been disclosed; technical details are provided but no patch, exploit code, or evidence of active exploitation is mentioned.