CVE-2020-12054

nvd nist nuclei

Published: Apr 23, 2020Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.

Affected (1)

Products: Catchplugins: Catch Breadcrumb

1 product

Catch Breadcrumb

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Catchplugins Catch Breadcrumb	Before 1.5.4

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://cxsecurity.com/issue/WLB-2020040144

Source: cve@mitre.org

ExploitThird Party Advisory

https://wpvulndb.com/vulnerabilities/10184

Source: cve@mitre.org

Third Party Advisory

https://cxsecurity.com/issue/WLB-2020040144

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://wpvulndb.com/vulnerabilities/10184

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.