CVE-2023-3708
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Several WordPress themes by DeoThemes are vulnerable to reflected Cross-Site Scripting (XSS) via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts on pages.
Risk Assessment
Attackers can exploit this vulnerability to inject malicious scripts, potentially leading to user data theft or session hijacking. The risk increases when users are tricked into clicking malicious links.
Recommendation
It is recommended to update WordPress themes to the latest versions that address this vulnerability. Additionally, implementing XSS protection mechanisms such as Content Security Policy (CSP) is advisable.
Original NVD description (English source)
Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.