Enfold Theme < 4.8.4 - Reflected Cross-Site Scripting (XSS)
CVE-2021-24719

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Enfold
Vendor
CVE Published:
11 October 2021

Summary

The Enfold Enfold WordPress theme before 4.8.4 was vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability is present on Enfold versions previous than 4.8.4 which use Avia Page Builder.

Affected Version(s)

Enfold 4.8.4

References

https://wpscan.com/vulnerability/a53e213f-6011-47f8-93e6-...
x_refsource_MISC
http://packetstormsecurity.com/files/164548/WordPress-Enf...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

David Álvarez Robles
Francisco Díaz-Pache Alonso
Sergio Corral Cristo
.