Vulnerability CVE-2019-20211
Published: 2020-01-13

Description:
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing Address, Listing Latitude, Listing Longitude, Email Address, Description, Name, Job or Position, Description, Service Name, Address, Latitude, Longitude, Phone Number, or Website.

Type:

CWE-79

 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Cththemes -> Citybook 
Cththemes -> Easybook 
Cththemes -> Townhub 

 References:
https://cxsecurity.com/issue/WLB-2019120110
https://cxsecurity.com/issue/WLB-2019120111
https://cxsecurity.com/issue/WLB-2019120112
https://themeforest.net/item/citybook-directory-listing-wordpress-theme/21694727
https://themeforest.net/item/easybook-directory-listing-wordpress-theme/23206622
https://themeforest.net/item/townhub-directory-listing-wordpress-theme/25019571
https://wpvulndb.com/vulnerabilities/10013
https://wpvulndb.com/vulnerabilities/10014
https://wpvulndb.com/vulnerabilities/10018
Copyright 2024, cxsecurity.com

 

Back to Top