The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the update_layout function in versions up to, and including, 6.2.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers, and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
Configurations
History
21 Nov 2024, 05:30
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.4 |
| References | () https://blog.nintechnet.com/avada-wordpress-theme-fixed-multiple-vulnerabilities/ - Exploit | |
| References | () https://theme-fusion.com/security-fix-added-in-6-2-3/ - Release Notes | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/684a1e8e-30f2-47dd-9df6-145198030c52?source=cve - Third Party Advisory |
12 Jun 2023, 19:31
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CPE | cpe:2.3:a:theme-fusion:avada:*:*:*:*:*:wordpress:*:* | |
| References | (MISC) https://blog.nintechnet.com/avada-wordpress-theme-fixed-multiple-vulnerabilities/ - Exploit | |
| References | (MISC) https://theme-fusion.com/security-fix-added-in-6-2-3/ - Release Notes | |
| References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/684a1e8e-30f2-47dd-9df6-145198030c52?source=cve - Third Party Advisory | |
| CWE | CWE-79 | |
| First Time |
Theme-fusion
Theme-fusion avada |
07 Jun 2023, 02:45
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-07 02:15
Updated : 2024-11-21 05:30
NVD link : CVE-2020-36711
Mitre link : CVE-2020-36711
CVE.ORG link : CVE-2020-36711
JSON object : View
Products Affected
theme-fusion
- avada
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')