CVE-2020-12054

MEDIUMNuclei

WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-12054 has a selected CVSS score of 6.1 (medium); EIP currently links 1 curated repository PoC and 1 Nuclei template.

Description

The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
1
Nuclei templates
1

Proofs of concept

1

Curated repository PoCs

GitHubCVE-2020-12054Curated repository PoCby yubsy112Not analyzed1 file

Python · 2.6 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Catch Breadcrumb <1.5.4 - Cross-Site ScriptingCVSS 6.1

WordPress Catch Breadcrumb plugin before 1.5.4 contains a reflected cross-site scripting vulnerability via the s parameter (a search query). Also affected are 16 themes if the plugin is enabled: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Update to the latest version of WordPress Catch Breadcrumb plugin (1.5.4 or higher) to mitigate the vulnerability.

WeaknessesCWE-79
Authorsdaffainfo
Template tagscvecve2020wordpressxsswp-pluginwpscancatchpluginsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:catchplugins:catch_breadcrumb:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/30a83491-2f59-4c41-98bd-a9e6e5a609d4 https://wpvulndb.com/vulnerabilities/10184 https://cxsecurity.com/issue/WLB-2020040144 https://nvd.nist.gov/vuln/detail/CVE-2020-12054 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3