boldthemes Vulnerabilities and Affected Products
Vulnerabilities associated with Bello - Directory & Listing.
Products
Clear product- Bold Page Builder33 vulnerabilities
- Bold Timeline Lite4 vulnerabilities
- Bello - Directory & Listing3 vulnerabilities
- Addison1 vulnerability
- Amwerk1 vulnerability
- Avantage1 vulnerability
- Celeste1 vulnerability
- Codiqa1 vulnerability
- DentiCare1 vulnerability
- Goldenblatt1 vulnerability
- Ippsum1 vulnerability
- Medicare1 vulnerability
- Nestin1 vulnerability
- Nifty1 vulnerability
- ReConstruction1 vulnerability
- Travelicious1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2021-24320MEDIUM | Bello < 1.6.0 - Unauthenticated Reflected XSS & XFSThe Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_listing_field_my_lat_default, bt_bb_listing_field_keyword, bt_bb_listing_field_location_autocomplete, bt_bb_listing_field_price_range_from and bt_bb_listing_field_price_range_to parameter in ints listing page, leading to reflected Cross-Site Scripting issues. | CVSS6.1v3.1 | EPSS10.8% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2021-24319MEDIUM | Bello < 1.6.0 - Authenticated Cross-Site Scripting (XSS) and XFSThe Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ page, leading to a Cross-Site Scripting issue CWE-79Jun 1, 2021 | CVSS5.4v3.1 | EPSS1.68% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-24321CRITICAL | Bello < 1.6.0 - Unauthenticated Blind SQL InjectionThe Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_now_open, bt_bb_listing_field_my_lng, listing_list_view and bt_bb_listing_field_my_lat parameters before using them in a SQL statement, leading to SQL Injection issues CWE-89Jun 1, 2021 | CVSS9.8v3.1 | EPSS66.6% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |