Vulnerability · Published Mar 26, 2024 · Assigned by Patchstack
CVE-2023-28687Reflected Cross-Site Scripting (XSS) vulnerability in multiple WordPress themes
High 7.1
In plain English
A high-severity cross-site scripting in Glaze Blog Lite from perfectwpthemes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Official description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in perfectwpthemes Glaze Blog Lite, themebeez Fascinate, themebeez Cream Blog, themebeez Cream Magazine allows Reflected XSS.This issue affects Glaze Blog Lite: from n/a through <= 1.1.4; Fascinate: from n/a through 1.0.8; Cream Blog: from n/a through 2.1.3; Cream Magazine: from n/a through 2.1.4.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| perfectwpthemes | Glaze Blog Lite | n/a – through <= 1.1.4 |
| themebeez | Fascinate | n/a – through 1.0.8 |
| themebeez | Cream Blog | n/a – through 2.1.3 |
| themebeez | Cream Magazine | n/a – through 2.1.4 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
References
- https://patchstack.com/database/vulnerability/glaze-blog-lite/wordpress-glaze-blog-lite-theme-1-1-4-cross-site-scripting-xss-vulnerability vdb-entry
- https://patchstack.com/database/vulnerability/fascinate/wordpress-fascinate-theme-1-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/vulnerability/cream-blog/wordpress-cream-blog-theme-2-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/vulnerability/cream-magazine/wordpress-cream-magazine-theme-2-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry