CVE-2021-24320CWE-79

Bello < 1.6.0 - Unauthenticated Reflected XSS & XFS

published June 1, 2021

CVSS

—

EPSS

11%

Percentile

95.8

In the wild

Unconfirmed

What it is

The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_listing_field_my_lat_default, bt_bb_listing_field_keyword, bt_bb_listing_field_location_autocomplete, bt_bb_listing_field_price_range_from and bt_bb_listing_field_price_range_to parameter in ints listing page, leading to reflected Cross-Site Scripting issues.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.10769 · 95.8th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2021-06-01T11:33Z

EPSS history

Timeline

01 JUN 11:33Z
Bello < 1.6.0 - Unauthenticated Reflected XSS & XFS
cvelistv5