CVE-2021-24235

CVE-2021-24235 concerns the WordPress Goto Tour & Travel Theme prior to 2.0, where the Tour List page fails to sanitise the keywords and start_date GET parameters. This causes an unauthenticated reflected cross-site scripting vulnerability. Connected sources (Nuclei template, Red Hat advisory, CV...

CVE-2021-24314

CVE-2021-24314 affects the Goto WordPress theme prior to 2.1. The vulnerability arises from failure to sanitize/validate/escape the GET parameter used on the theme’s listing page, allowing an unauthenticated SQL injection via the keywords parameter. Public references (CVE records, WPVulnDB, and P...

CVE-2021-24297

The CVE-2021-24297 entry applies to the WordPress Goto theme prior to version 2.1, where the tl_filter AJAX action did not properly sanitize the formvalue JSON POST parameter. This caused an unauthenticated reflected XSS vulnerability. Affected product: Goto WordPress theme (