CVE-2021-24235
MEDIUM NUCLEIGoto WordPress Theme < 2.0 - Unauthenticated Reflected Cross-Site Scripting via Tour List Page Parameters
Title source: llmExploitation Summary
CVE-2021-24235 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.
Description
The Goto WordPress theme before 2.0 does not sanitise the keywords and start_date GET parameter on its Tour List page, leading to an unauthenticated reflected Cross-Site Scripting issue.
Nuclei Templates (1)
WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting
MEDIUMby daffainfo
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_confirm
https://wpscan.com/vulnerability/eece90aa-582b-4c49-8b7c-14027f9df139
Various Sources x_refsource_misc
https://m0ze.ru/vulnerability/%5B2021-02-10%5D-%5BWordPress%5D-%5BCWE-79%5D-Goto-WordPress-Theme-v1.9.txt
Scores
CVSS v3
6.1
EPSS
0.0293
EPSS Percentile
85.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
boostifythemes/goto
< 2.0
Published
Apr 22, 2021
Tracked Since
Feb 18, 2026