This is a stored XSS vulnerability in the Zoo extension for YOOtheme's CMS platform, and the severity metrics undersell the actual risk. The CVSS 8.6 score reflects the technical severity, but the exploitable condition is worse than the number suggests: unauthenticated attackers can inject malicious scripts into custom field content that gets stored and rendered to every visitor of any page using those fields. No authentication required. No user interaction required. Anyone viewing an affected page becomes a victim automatically.
The vulnerability lives in the field customization system — the component explicitly designed to let developers create custom content types with user-supplied field elements. The fix was adding htmlspecialchars() to the output path for user-supplied field content. That single line of escaping was missing from a specific code path that handles how field values get rendered. This isn't a complex memory corruption or cryptographic failure; it's the absence of output encoding on user-controlled content rendered in an unauthenticated context.
If you're defending Zoo-powered sites, your priority list is straightforward: identify every deployment running Zoo versions below 4.1.66, audit which content types and field configurations are in use, and understand that the patch may break legitimate custom field setups that depended on the bypass now being closed. The security team needs to coordinate with content editors — sites that built custom field workflows around the pre-patch behavior will face a genuine trade-off between security compliance and operational continuity. This isn't hypothetical; the commercial extension context means some sites invested significantly in the flexibility that created the vulnerability.
The blast radius is the real story here. A field customization system that accepts user content without escaping doesn't create one vulnerable code path — it creates a vulnerable surface that scales with every custom field, every content type, and every extension that inherits the same architectural pattern. Patching this specific instance doesn't automatically protect parallel structures in other extensions that learned the same patterns from the same ecosystem incentives. Assume this vulnerability class will recur in other Zoo extensions until the platform architecturally prevents extension override of output encoding.