PT-2021-15857 · WordPress · The Bello

M0Ze + 1 · Published 2021-06-01 · Updated 2021-08-12 · CVE-2021-24320

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Bello - Directory & Listing WordPress theme versions prior to 1.6.0

Description The issue arises from the theme's failure to properly sanitise and escape certain parameters in its listing page, leading to reflected Cross-Site Scripting issues. The affected parameters include listing list view, bt bb listing field my lat, bt bb listing field my lng, bt bb listing field distance value, bt bb listing field my lat default, bt bb listing field keyword, bt bb listing field location autocomplete, bt bb listing field price range from, and bt bb listing field price range to.

Recommendations For versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the listing page or disabling the vulnerable parameters until a patch is available. Avoid using the vulnerable parameters in the listing page until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24320

Affected Products

The Bello

References · 5

• 🔥 https://wpscan.com/vulnerability/6b5b42fd-028a-4405-b027-3266058029bb · Exploit
• 🔥 https://m0ze.ru/vulnerability/%5B2021-03-21%5D-%5BWordPress%5D-%5BCWE-79%5D-Bello-WordPress-Theme-v1.5.9.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24320 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24320 · Vendor Advisory
• https://t.me/cvenotify/15308 · Telegram Post