Themes Vulnerabilities

Winters theme <= 1.4.3 - Reflected Cross-Site Scripting via Prototype Pollution

Description

The theme does not properly sanitize user inputs nor escape output, leading to a reflected Cross-Site Scripting vulnerability via prototype pollution.

Affects Themes

winters
No known fix

References

CVE
CVE-2023-3962
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/6f8b75a1-f0f2-445b-a1c7-1628916470d3

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
longxi
Verified
No
WPVDB ID
f10998d2-0589-4c28-9f47-ad798f862aed

Timeline

Publicly Published
2023-07-26 (about 2 years ago)
Added
2023-11-03 (about 2 years ago)
Last Updated
2023-11-03 (about 2 years ago)

Other

Published
Title
Published
2024-05-31
Title
Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder < 2.5.52 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-07-10
Title
Calendar.online / Kalender.digital < 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-04-11
Title
Nepali Date Converter < 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2020-01-29
Title
Elementor Page Builder < 2.8.5 - Authenticated Reflected XSS
Published
2025-03-17
Title
Já-Já Pagamentos for WooCommerce <= 1.3.0 - Reflected Cross-Site Scripting