CVE-2022-2654 — Classima < 2.1.11 - Reflected Cross-Site Scripting

Description (CNA)

The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store & Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting

Affected (CNA)

Vendor / product	Versions
Unknown / Classified Listing – Classified ads & Business Directory Plugin	affected 2.2.14 before 2.2.14
Unknown / Classified Listing Pro - Classified ads & Business Directory Plugin	affected 2.0.20 before 2.0.20
Unknown / Classified Listing Store & Membership Addon	affected 1.4.20 before 1.4.20
Unknown / Classima Core	affected 1.10 before 1.10
Unknown / Classima	affected 2.1.11 before 2.1.11

CWE

CWE-79

References

https://wpscan.com/vulnerability/845f44ca-f572-48d7-a19a-89cace0b8993

ADP enrichment

CVE

No English description supplied.

https://wpscan.com/vulnerability/845f44ca-f572-48d7-a19a-89cace0b8993

CISA-ADP

No English description supplied.

No references supplied.