Vulnerability · Published May 24, 2021 · Assigned by WPScan

CVE-2021-24297Goto < 2.1 - Reflected Cross-Site Scripting (XSS)

Medium 6.1

In plain English

A medium-severity cross-site scripting in Goto from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)0.8%top 42.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Goto WordPress theme before 2.1 did not properly sanitize the formvalue JSON POST parameter in its tl_filter AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Goto	2.1 – before 2.1

Weakness: CWE-79

References

https://wpscan.com/vulnerability/a64a3b2e-7924-47aa-96e8-3aa02a6cdccc x_refsource_CONFIRM