ZOO security vulnerabilities

mySites.guru tracks 3vulnerabilities in com_zoo. Every connected Joomla site is checked against them on each audit, and flagged if it runs an affected version.

Check whether your sites are affected

What we check for

ZOO (com_zoo) below 4.1.64 - Unauthenticated Arbitrary File Upload (RCE, CVSS 10.0), Unauthenticated SQL Injection (CVSS 9.3) and Open Redirect

Affected versions: < 4.1.64

ZOO (com_zoo) 4.1.64 - Unauthenticated Tag Modification (CVE-2026-76610, CVSS 6.9)

Affected versions: ≥ 4.1.64 and < 4.1.65

ZOO (com_zoo) 4.1.65 - Unauthenticated Stored XSS (CVSS 8.6), Unauthenticated Arbitrary Directory Listing (6.9), Reflected XSS and Open Redirect (5.3), and Missing Front-End CSRF Protection

Affected versions: ≥ 4.1.65 and < 4.1.66

What we have written about ZOO

A CVSS 10.0 Unauthenticated Upload in YOOtheme ZOO, Fixed in 4.1.66

YOOtheme ZOO (com_zoo) up to 4.1.63 had an unauthenticated file upload RCE scored CVSS 10.0, plus an unauthenticated SQL injection. Those are fixed in 4.1.64. Two more releases followed inside three days, closing five more issues between them, one of them scored 8.6. Install 4.1.66.

19 Aug 2026

Running ZOO on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

Rules current as of 24 August 2026.