A vulnerability exists in the Zoo extension for Joomla versions earlier than 4.1.66 where user supplied input in comments and custom field elements is not escaped before rendering, allowing an attacker to embed arbitrary script code. This stored cross‑site scripting flaw is classified as CWE‑79. If triggered, malicious code would run in the browser context of any visitor to a page displaying the affected content, potentially leading to credential theft, session hijacking, or defacement, while not modifying the underlying database directly.

Systems using the yootheme.com Zoo extension for Joomla that are running a version earlier than 4.1.66 are affected. This includes any Joomla site that has incorporated Zoo before the indicated release, regardless of whether the site is publicly exposed or restricted to internal users.

The flaw carries a CVSS v3.1 score of 8.6, indicating high severity. No EPSS score is provided, and the vulnerability is currently not listed in CISA's KEV catalog, suggesting it has not yet been actively exploited at scale. Attackers can trigger the issue without authentication by submitting malicious scripts via the comment form or by creating entries with injected scripts in user‑supplied field elements, thereby achieving a stored XSS vector that will execute on any subsequent page view.