CVE-2020-36510

MEDIUMNuclei

15Zine < 3.3.0 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2020-36510 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s_a AJAX action, leading to a Reflected Cross-Site Scripting

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

15Zine

CVE List3.3.0 to < 3.3.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress 15Zine <3.3.0 - Cross-Site ScriptingCVSS 6.1

WordPress 15Zine before 3.3.0 is vulnerable to reflected cross-site scripting because the theme does not sanitize the cbi parameter before including it in the HTTP response via the cb_s_a AJAX action.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of a victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Update WordPress 15Zine to version 3.3.0 or later to mitigate the vulnerability.

WeaknessesCWE-79
Authorsveshraj
Template tagscve2020cvexsswordpresswp-themewpwpscancodetipivuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:codetipi:15zine:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/d1dbc6d7-7488-40c2-bc38-0674ea5b3c95 https://nvd.nist.gov/vuln/detail/CVE-2020-36510 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2