PT-2020-13019 · Catch Themes · Catch Breadcrumb

Published 2020-04-23 · Updated 2020-04-30 · CVE-2020-12054

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Catch Breadcrumb plugin versions prior to 1.5.4

Description The issue allows Reflected XSS via the s parameter, which is a search query. This affects not only the Catch Breadcrumb plugin but also 16 themes by the same author if the plugin is enabled. These themes include Alchemist, Alchemist PRO, Izabel, Izabel PRO, Chique, Chique PRO, Clean Enterprise, Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.

Recommendations For versions prior to 1.5.4, update the Catch Breadcrumb plugin to version 1.5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the s parameter in search queries until the plugin is updated.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-12054

Affected Products

Catch Breadcrumb

References · 5

• 🔥 https://cxsecurity.com/issue/WLB-2020040144 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-12054 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12054 · Vendor Advisory
• https://t.me/cvenotify/3099 · Telegram Post
• https://wpvulndb.com/vulnerabilities/10184 · Note