CVE-2011-3855

F8 Lite < 4.2.2 - Cross-Site Scripting via s Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2011-3855. PoCs published by SiteWatch.

AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in the F8 Lite theme for WordPress versions prior to 4.2.2. It explains the issue and provides a sample exploit URL but does not include functional exploit code.

Description

Cross-site scripting (XSS) vulnerability in the F8 Lite theme before 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED
by SiteWatch · textwebappsphp
https://www.exploit-db.com/exploits/36180

The provided text describes a cross-site scripting (XSS) vulnerability in the F8 Lite theme for WordPress versions prior to 4.2.2. It explains the issue and provides a sample exploit URL but does not include functional exploit code.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: F8 Lite theme for WordPress < 4.2.2
No auth needed
Prerequisites: A vulnerable version of the F8 Lite theme for WordPress · User interaction to visit a crafted URL
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, URL Repurposed x_refsource_misc
https://sitewat.ch/en/Advisories/13

Scores

EPSS 0.0313
EPSS Percentile 86.2%

Details

CWE
CWE-79
Status published
Products (7)
graphpaperpress/f8_lite 1.1
graphpaperpress/f8_lite 1.2
graphpaperpress/f8_lite 1.3
graphpaperpress/f8_lite 2.0.1
graphpaperpress/f8_lite 4.1
graphpaperpress/f8_lite 4.2.0
graphpaperpress/f8_lite < 4.2.1
Published Sep 28, 2011
Tracked Since Feb 18, 2026