PT-2024-13815 · Klbtheme · Klbtheme Bacola+5

Fearzzzz + 2 · Published 2024-03-26 · Updated 2024-03-29 · CVE-2023-49839

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions KlbTheme Cosmetsy theme (core plugin) versions 1.3.0 and earlier KlbTheme Partdo theme (core plugin) versions 1.0.9 and earlier KlbTheme Bacola theme (core plugin) versions 1.3.3 and earlier KlbTheme Medibazar theme (core plugin) versions 1.2.3 and earlier KlbTheme Furnob theme (core plugin) versions 1.1.7 and earlier KlbTheme Clotya theme (core plugin) versions 1.1.5 and earlier

Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), which allows Reflected XSS. This means that an attacker can inject malicious code into a website, potentially stealing user data or taking control of the user's session. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For KlbTheme Cosmetsy theme (core plugin) versions 1.3.0 and earlier, update to a version later than 1.3.0. For KlbTheme Partdo theme (core plugin) versions 1.0.9 and earlier, update to a version later than 1.0.9. For KlbTheme Bacola theme (core plugin) versions 1.3.3 and earlier, update to a version later than 1.3.3. For KlbTheme Medibazar theme (core plugin) versions 1.2.3 and earlier, update to a version later than 1.2.3. For KlbTheme Furnob theme (core plugin) versions 1.1.7 and earlier, update to a version later than 1.1.7. For KlbTheme Clotya theme (core plugin) versions 1.1.5 and earlier, update to a version later than 1.1.5. As a temporary workaround, consider disabling the affected theme until a fix is applied. Review themes and update them as soon as possible.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-49839

Affected Products

Klbtheme Bacola

Klbtheme Clotya

Klbtheme Cosmetsy

Klbtheme Furnob

Klbtheme Medibazar

Klbtheme Partdo

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2023-49839 · Security Note
• https://twitter.com/oktsec/status/1773757458382463314 · Twitter Post
• https://t.me/cvenotify/74654 · Telegram Post
• https://patchstack.com/database/vulnerability/furnob-core/wordpress-furnob-core-plugin-1-1-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/cosmetsy-core/wordpress-cosmetsy-core-plugin-1-3-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/bacola-core/wordpress-bacola-core-plugin-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/partdo-core/wordpress-partdo-core-plugin-1-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/clotya-core/wordpress-clotya-core-plugin-1-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1772538645620142588 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1772575564894711896 · Twitter Post
• https://patchstack.com/database/vulnerability/medibazar-core/wordpress-medibazar-core-plugin-1-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note