CVE-2021-24320

The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_listing_field_my_lat_default, bt_bb_listing_field_keyword, bt_bb_listing_field_location_autocomplete, bt_bb_listing_field_price_range_from and bt_bb_listing_field_price_range_to parameter in ints listing page, leading to reflected Cross-Site Scripting issues.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

10.77% chance of exploitation in the next 30 days, 96th percentile

Nuclei

medium · CWE-79

Published

2021-06-01

Updated

2024-08-03

Proof-of-concept exploits (2)

• https://m0ze.ru/vulnerability/%5B2021-03-21%5D-%5BWordPress%5D-%5BCWE-79%5D-Bello-WordPre…
• https://wpscan.com/vulnerability/6b5b42fd-028a-4405-b027-3266058029bb

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24320.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-24319
• CVE-2021-24321
• CVE-2021-24318
• CVE-2021-24322
• CVE-2021-24317
• CVE-2021-24323