Xenon Theme <= 1.3 - Unauthenticated Cross-Site Scripting (XSS)

The premium Xenon WordPress theme was found to be vulnerable to Unauthenticated Cross-Site Scripting (XSS) in the “q” parameter of the /data/typeahead-generate.php page. The affected version of the plugin was 1.3 and below, however, the vendor fixed the vulnerability but did not bump the version number. Therefore it is impossible to know which versions have been patched, or not. This issue will be updated as soon as we are aware that a new version, with the fix, has been released. If this has happened and we have not updated it yet, please contact us and we’ll update this issue.

PoC

1. go to this path /data/typeahead-generate.php 2. enter this payload in q parameter