Themes Vulnerabilities

CarePlus <= 1.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)

Description

An Unauthenticated Reflected XSS vulnerability was discovered in the CarePlus theme through 1.2 for WordPress.

Proof of Concept

Affects Themes

careplus
No known fix

References

URL
https://themeforest.net/item/careplus-responsive-medical-wordpress-theme/20602278
URL
https://github.com/vladvector/vladvector.github.io/blob/master/exploit/2020-07-01-careplus-health-medical-responsive-wordpress-theme-v1-2.txt

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Vlad Vector
Submitter
VLΛD VΞCTOR
Submitter website
https://vladvector.ru
Submitter twitter
vlad_vector
Verified
Yes
WPVDB ID
a2a31d8f-1a42-42f2-8768-5b18554b66dc

Timeline

Publicly Published
2020-07-27 (about 5 years ago)
Added
2020-07-27 (about 5 years ago)
Last Updated
2020-07-28 (about 5 years ago)

Other

Published
Title
Published
2026-02-11
Title
Duplicate Post < 3.2.4 - Admin+ Stored XSS
Published
2023-11-08
Title
Add to Calendar Button < 1.5.1 - Contributor+ Stored XSS
Published
2022-01-06
Title
WordPress < 5.8.3 - Author+ Stored XSS via Post Slugs
Published
2020-06-19
Title
TownHub < 1.3.0 - Unauthenticated Reflected XSS
Published
2025-04-22
Title
Theme Switcha < 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting