CVE-2020-12054
Medium
Description
The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.
SeverityMedium
CVSS6.1
Exploit probability—
ProductCatchplugins Catch Breadcrumb
PublishedApr 23, 2020
First seenApr 23, 2020
How to fix
Update
- catchplugins catch_breadcrumb1.5.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| catchplugins catch_breadcrumb | v < 1.5.4 | 1.5.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.