Cross site scripting

2022-09-1609:15:00

PRIOn knowledge base

www.prio-n.com

0.001 Low

EPSS

Percentile

40.3%

JSON

The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store & Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting

CPENameOperatorVersion
classified_listing_-_classified_ads_\\&_business_directorylt2.2.14
classified_listing_pro_-_classified_ads_\\&_business_directorylt2.0.20
classified_listing_store_\\&_membershiplt1.4.20
classimalt2.1.11
classima_corelt1.10

Name	Operator	Version
classified_listing_-_classified_ads_\\&_business_directory	lt	2.2.14
classified_listing_pro_-_classified_ads_\\&_business_directory	lt	2.0.20
classified_listing_store_\\&_membership	lt	1.4.20
classima	lt	2.1.11
classima_core	lt	1.10

References

wpscan.com/vulnerability/845f44ca-f572-48d7-a19a-89cace0b8993

0.001 Low

EPSS

Percentile

40.3%

JSON

Related for PRION:CVE-2022-2654