CVE-2023-3708: Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output…

Description

Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.6% · higher than 48% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AM

Amela · Deothemes

before 1.0.14 · source: NVD

AR

Arendelle · Deothemes

before 1.1.13 · source: NVD

EV

Everse · Deothemes

before 1.8.12 · source: NVD

ME

Medikaid · Deothemes

before 1.1.3 · source: NVD

NO

Nokke · Deothemes

before 1.2.4 · source: NVD