Themes Vulnerabilities
Avada < 6.2.3 - Missing Permission Checks leading to Arbitrary Post Creation, Edition, Deletion and Stored XSS
Description
NinTechNet disclosed multiple security vulnerabilities affecting the premium Avada WordPress theme on their blog after responsibly disclosing the security vulnerabilities to Avada.
These vulnerabilities included:
- Content Injection & Stored XSS
- Arbitrary Post Deletion
- Arbitrary Post Creation
These vulnerabilities were reportedly fixed in Avada version 6.2.3, released on April 24th 2020.
Affects Themes
Fixed in 6.2.3 References
Classification
Type
PRIVESC
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Jerome Bruandet (nintechnet.com)
Verified
No
WPVDB ID
Timeline
Publicly Published
2020-05-01 (about 6 years ago)
Added
2020-05-01 (about 6 years ago)
Last Updated
2023-06-08 (about 2 years ago)
WPScan 