Vulnerability · Published Jul 18, 2023 · Assigned by Wordfence

CVE-2023-3708Multiple DeoThemes Themes <= (Various Versions) - Reflected Cross-Site Scripting

Medium 6.1

In plain English

A medium-severity cross-site scripting in Amela from deothemes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.6%top 51.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affected products (as reported)

Vendor	Product	Versions
deothemes	Amela	0 – through 1.0.13
Deothemes	MedikAid \| Medical Health Care RTL WordPress Theme	0 – through 1.1.2
deothemes	Arendelle	0 – through 1.1.12
deothemes	Nokke	0 – through 1.2.3
deothemes	Everse	0 – through 1.8.10

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In plain English

Official description

Affected products (as reported)

References