PT-2021-15779 · WordPress · Goto

M0Ze + 1 · Published 2021-04-22 · Updated 2021-04-29 · CVE-2021-24235

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Goto WordPress theme versions prior to 2.0

Description The issue is related to an unauthenticated reflected Cross-Site Scripting problem. It occurs because the Goto WordPress theme does not properly sanitise the keywords and start date GET parameters on its Tour List page. This allows for malicious scripts to be injected and executed, potentially leading to security breaches.

Recommendations For versions prior to 2.0, update to version 2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Tour List page or sanitising the keywords and start date parameters to prevent malicious input.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24235

Affected Products

Goto

References · 6

• 🔥 https://m0ze.ru/vulnerability/[2021-02-10]-[WordPress]-[CWE-79]-Goto-WordPress-Theme-v1.9.txt · Exploit
• 🔥 https://wpscan.com/vulnerability/eece90aa-582b-4c49-8b7c-14027f9df139 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24235 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24235 · Security Note
• https://m0ze.ru/vulnerability/%5B2021-02-10%5D-%5BWordPress%5D-%5BCWE-79%5D-Goto-WordPress-Theme-v1.9.txt · Note
• https://t.me/cvenotify/13551 · Telegram Post