Security
Critical YOOtheme Pro 5 update scheduled for 21 October
YOOtheme has warned that every site running YOOtheme Pro 5 needs a critical security update scheduled for 21 October 2026.
mySites.guru reports that YOOtheme has scheduled the patched release for 16:00 CEST (14:00 UTC) on 21 October 2026. The update will appear in the YOOtheme Pro changelog, but the fixed version number has not yet been announced.
The vendor has not disclosed the vulnerability class or assigned a CVE identifier. It rates the issue as critical. Exploitation status has also not been disclosed; according to mySites.guru, the issue was reported to YOOtheme by a third party and has not been investigated by the publisher.
- Every build of
YOOtheme Pro 5is affected. YOOtheme Pro 4and earlier are not affected.- No workaround or pre-release mitigation is stated.
Administrators should confirm which Joomla sites use YOOtheme Pro 5, create fresh backups, and update as soon as the patched build is available. Sites on Pro 4 or earlier do not require action for this issue.
Originally reported by mySites.guru.