CVE-2023-49839
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Cosmetsy theme (core plugin), KlbTheme Partdo theme (core plugin), KlbTheme Bacola theme (core plugin), KlbTheme Medibazar theme (core plugin), KlbTheme Furnob theme (core plugin), KlbTheme Clotya theme (core plugin) allows Reflected XSS.This issue affects Cosmetsy theme (core plugin): from n/a through 1.3.0; Partdo theme (core plugin): from n/a through 1.0.9; Bacola theme (core plugin): from n/a through 1.3.3; Medibazar theme (core plugin): from n/a through 1.2.3; Furnob theme (core plugin): from n/a through 1.1.7; Clotya theme (core plugin): from n/a through 1.1.5.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| KlbTheme Cosmetsy theme (core plugin) | v ≤ 1.3.0 | — |
| KlbTheme Partdo theme (core plugin) | v ≤ 1.0.9 | — |
| KlbTheme Bacola theme (core plugin) | v ≤ 1.3.3 | — |
| KlbTheme Medibazar theme (core plugin) | v ≤ 1.2.3 | — |
| KlbTheme Furnob theme (core plugin) | v ≤ 1.1.7 | — |
| KlbTheme Clotya theme (core plugin) | v ≤ 1.1.5 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.