WordPress Plugin Vulnerabilities

Multiple Plugins by KlbTheme - Reflected Cross-Site Scripting

Description

The plugins do not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affects Plugins

Plugin icon
bacola-core
No known fix
Plugin icon
clotya-core
No known fix
Plugin icon
cosmetsy-core
No known fix
Plugin icon
furnob-core
No known fix
Plugin icon
medibazar-core
No known fix
Plugin icon
partdo-core
No known fix

References

CVE
CVE-2023-49839
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/4fb06315-30ad-4d98-af75-b04933583be7

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Vladislav Pokrovsky (ΞX.MI)
Verified
No
WPVDB ID
ce2a2e77-9279-43d0-9209-2a13ecae6338

Timeline

Publicly Published
2023-12-07 (about 5 months ago)
Added
2023-12-13 (about 5 months ago)
Last Updated
2023-12-13 (about 5 months ago)

Other

Published
Title
Published
2023-02-21
Title
Smart Logo Showcase Lite <= 1.1.9 - Contributor+ Stored XSS
Published
2021-03-28
Title
Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS)
Published
2024-03-25
Title
Off-Canvas Sidebars & Menus (Slidebars) < 0.5.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2016-05-30
Title
wpDiscuz < 3.2.0 - Reflected Cross-Site Scripting (XSS)
Published
2016-02-04
Title
Universal Analytics <= 1.3.0 - Authenticated Cross-Site Scripting (XSS)