Reflected Cross-Site Scripting vulnerability in multiple WordPress components by KlbTheme

7.1 CVSS

Vulnerability Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Cosmetsy theme (core plugin), KlbTheme Partdo theme (core plugin), KlbTheme Bacola theme (core plugin), KlbTheme Medibazar theme (core plugin), KlbTheme Furnob theme (core plugin), KlbTheme Clotya theme (core plugin) allows Reflected XSS.This issue affects Cosmetsy theme (core plugin): from n/a through 1.3.0; Partdo theme (core plugin): from n/a through 1.0.9; Bacola theme (core plugin): from n/a through 1.3.3; Medibazar theme (core plugin): from n/a through 1.2.3; Furnob theme (core plugin): from n/a through 1.1.7; Clotya theme (core plugin): from n/a through 1.1.5.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-49839

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

FearZzZz (Patchstack Alliance)

References

More from KlbTheme

View All →

CVE-2023-49838

Cross-Site Request Forgery (CSRF) vulnerability in multiple themes by KlbTheme

Medium 4.3

CVE-2023-49186

WordPress Machic Core plugin <= 1.2.6 - Reflected Cross Site Scripting (XSS) vulnerability

High 7.1

Affected Vendor

KlbTheme

View all reports →

Affected Software

Cosmetsy theme (core plugin), Partdo theme (core plugin), Bacola theme (core plugin), Medibazar theme (core plugin), Furnob theme (core plugin), Clotya theme (core plugin)

Vulnerable Versions:

Unknown