CVE-2021-24319CWE-79

Bello < 1.6.0 - Authenticated Cross-Site Scripting (XSS) and XFS

published June 1, 2021

CVSS
—
EPSS
2%
Percentile
76.8
In the wild
Unconfirmed
What it is

The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ page, leading to a Cross-Site Scripting issue

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01681 · 76.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-06-01T11:33Z
EPSS history
Timeline
  • 01 JUN 11:33Z
    Bello < 1.6.0 - Authenticated Cross-Site Scripting (XSS) and XFS
    cvelistv5