Themes Vulnerabilities
Xenon Theme <= 1.3 - Unauthenticated Cross-Site Scripting (XSS)
Description
The premium Xenon WordPress theme was found to be vulnerable to Unauthenticated Cross-Site Scripting (XSS) in the "q" parameter of the /data/typeahead-generate.php page. The affected version of the plugin was 1.3 and below, however, the vendor fixed the vulnerability but did not bump the version number. Therefore it is impossible to know which versions have been patched, or not. This issue will be updated as soon as we are aware that a new version, with the fix, has been released. If this has happened and we have not updated it yet, please contact us and we'll update this issue.
Proof of Concept
Affects Themes
No known fix References
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Khaled Nassar
Verified
No
WPVDB ID
Timeline
Publicly Published
2020-03-26 (about 6 years ago)
Added
2020-06-15 (about 5 years ago)
Last Updated
2020-08-12 (about 5 years ago)
WPScan 