CVE-2021-24320
Assigner: WPScan
Published: 2021-06-01T11:33:30
State: PUBLISHED
affected: product: Bello - Directory & Listing
vendor: BoldThemes
versions: lessThan: 1.6.0
status: affected
version: 1.6.0
versionType: custom
credits: value: m0ze
descriptions: value: The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_listing_field_my_lat_default, bt_bb_listing_field_keyword, bt_bb_listing_field_location_autocomplete, bt_bb_listing_field_price_range_from and bt_bb_listing_field_price_range_to parameter in ints listing page, leading to reflected Cross-Site Scripting issues.
problemTypes: descriptions: cweId: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
type: CWE
source: discovery: UNKNOWN
title: Bello < 1.6.0 - Unauthenticated Reflected XSS & XFS
x_generator: WPScan CVE Generator