CVSS: 6.1EPSS: 0%CPEs: 46EXPL: 1CVE-2023-2813 – Multiple Themes - Reflected XSS
https://notcve.org/view.php?id=CVE-2023-2813
All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2, BunnyPressLite WordPress theme before 2.1, Cafe Bistro WordPress theme before 1.1.4, College WordPress theme before 1.5.1, Connections Reloaded WordPress theme through 3.1, Counterpoint WordPress theme through 1.8.1, Digitally WordPress theme through 1.0.8, Directory WordPress theme before 3.0.2, Drop WordPress theme before 1.22, Everse WordPress theme before 1.2.4, Fashionable Store WordPress theme through 1.3.4, Fullbase WordPress theme before 1.2.1, Ilex WordPress theme before 1.4.2, Js O3 Lite WordPress theme through 1.5.8.2, Js Paper WordPress theme through 2.5.7, Kata WordPress theme before 1.2.9, Kata App WordPress theme through 1.0.5, Kata Business WordPress theme through 1.0.2, Looki Lite WordPress theme before 1.3.0, moseter WordPress theme through 1.3.1, Nokke WordPress theme before 1.2.4, Nothing Personal WordPress theme through 1.0.7, Offset Writing WordPress theme through 1.2, Opor Ayam WordPress theme through 18, Pinzolo WordPress theme before 1.2.10, Plato WordPress theme before 1.1.9, Polka Dots WordPress theme through 1.2, Purity Of Soul WordPress theme through 1.9, Restaurant PT WordPress theme before 1.1.3, Saul WordPress theme before 1.1.0, Sean Lite WordPress theme before 1.4.6, Tantyyellow WordPress theme through 1.0.0.5, TIJAJI WordPress theme through 1.43, Tiki Time WordPress theme through 1.3, Tuaug4 WordPress theme through 1.4, Tydskrif WordPress theme through 1.1.3, UltraLight WordPress theme through 1.2, Venice Lite WordPress theme before 1.5.5, Viala WordPress theme through 1.3.1, viburno WordPress theme before 1.3.2, Wedding Bride WordPress theme before 1.0.2, Wlow WordPress theme before 1.2.7 suffer from the same issue about the search box reflecting the results causing XSS which allows an unauthenticated attacker to exploit against users if they click a malicious link. Todo lo anterior: Tema de WordPress de Aapna hasta 1.3, Tema de WordPress de Anand hasta 1.2, Tema de WordPress de Anfaust hasta 1.1, Tema de WordPress de Arendelle antes de 1.1.13, Tema de WordPress de Atlast Business hasta 1.5.8.5, Tema de WordPress de Bazaar Lite antes de 1.8.6, Tema de WordPress de Brain Power hasta 1.2, tema de WordPress BunnyPressLite anterior a 2.1, tema de WordPress Cafe Bistro anterior a 1.1.4, tema de WordPress College anterior a 1.5.1, tema de WordPress Connections Reloaded hasta 3.1, tema de WordPress Counterpoint hasta 1.8.1, tema de WordPress digital hasta 1.0.8 , Tema Directory WordPress anterior a 3.0.2, Tema Drop WordPress anterior a 1.22, Tema Everse WordPress anterior a 1.2.4, Tema Fashionable Store WordPress hasta 1.3.4, Tema Fullbase WordPress anterior a 1.2.1, Tema Ilex WordPress anterior a 1.4.2, Tema Js O3 Lite WordPress hasta 1.5.8.2, tema Js Paper WordPress hasta 2.5.7, tema Kata WordPress anterior a 1.2.9, tema Kata App WordPress hasta 1.0.5, tema Kata Business WordPress hasta 1.0.2, tema Looki Lite WordPress anterior a 1.3. 0, tema de WordPress moseter hasta 1.3.1, tema de WordPress Nokke anterior a 1.2.4, tema de WordPress Nothing Personal hasta 1.0.7, tema de WordPress Offset Writing hasta 1.2, tema de WordPress Opor Ayam hasta 18, tema de WordPress Pinzolo anterior a 1.2.10, Plato Tema de WordPress anterior a 1.1.9, tema de WordPress Polka Dots hasta 1.2, tema de WordPress Purity Of Soul hasta 1.9, tema de WordPress Restaurant PT anterior a 1.1.3, tema de WordPress Saul anterior a 1.1.0, tema de WordPress Sean Lite anterior a 1.4.6, tema de WordPress TantyYellow tema hasta 1.0.0.5, tema TIJAJI WordPress hasta 1.43, tema Tiki Time WordPress hasta 1.3, tema Tuaug4 WordPress hasta 1.4, tema Tydskrif WordPress hasta 1.1.3, tema UltraLight WordPress hasta 1.2, tema Venice Lite WordPress antes 1.5.5, tema Viala de WordPress hasta 1.3.1, tema viburno de Wordpress anterior a 1.3.2, el tema de WordPress Wedding Bride anterior a 1.0.2, el tema de WordPress Wlow anterior a 1.2.7 sufren el mismo problema en el cuadro de búsqueda que refleja los resultados, lo que provoca XSS, lo que permite a un atacante no autenticado explotar contra los usuarios si hacen clic en un enlace malicioso. Multiple themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the search field in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://wpscan.com/vulnerability/f434afd3-7de4-4bf4-a9bb-9f9aeaae1dc5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.3EPSS: 0%CPEs: 425EXPL: 0CVE-2022-4974 – Freemius SDK <= 2.4.2 - Missing Authorization Checks
https://notcve.org/view.php?id=CVE-2022-4974
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable. • https://www.wordfence.com/threat-intel/vulnerabilities/id/39fb0499-9ab4-4a2f-b0db-ece86bcf4d42?source=cve https://wpscan.com/vulnerability/6dae6dca-7474-4008-9fe5-4c62b9f12d0a https://freemius.com/blog/managing-security-issues-open-source-freemius-sdk-security-disclosure https://wpdirectory.net/search/01FWPVWA7BC5DYGZHNSZQ9QMN5 https://wpdirectory.net/search/01G02RSGMFS1TPT63FS16RWEYR https://web.archive.org/web/20220225174410/https%3A//www.pluginvulnerabilities.com/2022/02/25/our-security-review-of-wordpress-plugin-found-freemius-li • CWE-862: Missing Authorization •