A high-severity Cross-site Scripting vulnerability in the YOOtheme Zoo extension for Joomla could allow unauthenticated attackers to execute arbitrary scripts in a user's browser.

The extension fails to properly sanitize user-supplied input, leading to a Cross-site Scripting (CWE-79) condition. This flaw allows an unauthenticated attacker to inject malicious scripts into web pages viewed by other users.

Successful exploitation allows attackers to steal session cookies, perform unauthorized actions on behalf of users, or redirect victims to malicious websites. With a CVSS score of 8.6, this vulnerability poses a significant risk to the integrity of user sessions and the overall security posture of the Joomla installation.

Immediate Action: Update the Zoo extension to the latest version provided by YOOtheme that incorporates the necessary security fixes.

Proactive Monitoring: Review web server and application logs for suspicious URL parameters or input patterns that indicate attempted script injection.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the sources from which scripts can be executed, reducing the impact of potential XSS attacks.

Public Exploit Available: No (exploit_available: false)

The high CVSS score reflects the ease of exploitation and the potential for significant user impact. Administrators should prioritize updating the Zoo extension immediately to eliminate this vulnerability and protect the user base from potential session hijacking.