PT-2023-25786 · Deothemes · Deothemes Wordpress Themes

Fearzzzz + 1 · Published 2023-07-18 · Updated 2026-02-06 · CVE-2023-3708

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DeoThemes WordPress themes (affected versions not specified)

Description The issue is related to Reflected Cross-Site Scripting via breadcrumbs in various versions of DeoThemes WordPress themes. This is due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages. These scripts execute if an attacker can trick a user into performing an action, such as clicking on a link.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-3708

Affected Products

Deothemes Wordpress Themes

References · 11

• https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=196758%40everse&new=196758%40everse&sfp_email=&sfph_mail= · Patch
• https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=196755%40nokke&new=196755%40nokke&sfp_email=&sfph_mail= · Patch
• https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=196756%40arendelle&new=196756%40arendelle&sfp_email=&sfph_mail= · Patch
• https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=196757%40amela&new=196757%40amela&sfp_email=&sfph_mail= · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-3708 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3708 · Vendor Advisory
• https://t.me/cveNotify/151215 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1b8b0f14-f31a-45cd-bb98-0b717059aa80?source=cve · Note
• https://deothemes.com/changelog/medikaid-changelog · Note
• https://t.me/cibsecurity/66879 · Telegram Post
• https://t.me/cvenotify/54538 · Telegram Post