CVE-2021-24321
Critical
Description
The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_now_open, bt_bb_listing_field_my_lng, listing_list_view and bt_bb_listing_field_my_lat parameters before using them in a SQL statement, leading to SQL Injection issues
SeverityCritical
CVSS9.8
Exploit probability—
ProductBold-themes Bello
PublishedJun 1, 2021
First seenJun 1, 2021
Weakness typeCWE-89SQL injection
How to fix
Update
- bold-themes bello1.6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bold-themes bello | v < 1.6.0 | 1.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.