Themes Vulnerabilities

Winters theme <= 1.4.3 - Reflected Cross-Site Scripting via Prototype Pollution

Description

The theme does not properly sanitize user inputs nor escape output, leading to a reflected Cross-Site Scripting vulnerability via prototype pollution.

Affects Themes

winters
No known fix

References

CVE
CVE-2023-3962
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/6f8b75a1-f0f2-445b-a1c7-1628916470d3

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
longxi
Verified
No
WPVDB ID
f10998d2-0589-4c28-9f47-ad798f862aed

Timeline

Publicly Published
2023-07-26 (about 9 months ago)
Added
2023-11-03 (about 6 months ago)
Last Updated
2023-11-03 (about 6 months ago)

Other

Published
Title
Published
2024-04-16
Title
Backend Designer < 1.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2014-08-01
Title
Your Text Manager < 0.3.0 - Cross-Site Scripting (XSS)
Published
2024-03-25
Title
VK All in One Expansion Unit < 9.97.0.0 - Contributor+ Stored XSS
Published
2021-12-01
Title
Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in General Module
Published
2022-03-28
Title
Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting