Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: boldthemes Component: Bello Clear all filters
TI-2021-06613 CVE-2021-24321 · GHSA-5mwv-pv28-2ghw

Bello < 1.6.0 - Unauthenticated Blind SQL Injection

Priority HIGH 78

The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_now_open, bt_bb_listing_field_my_lng, listing_list_view and bt_bb_listing_field_my…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.66576 Published 2021-06-01 Fixed in 1.6.0 CWE-89
TI-2021-06612 CVE-2021-24320 · GHSA-9x8w-jj9g-vgv3

Bello < 1.6.0 - Unauthenticated Reflected XSS & XFS

Priority MEDIUM 40

The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_l…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.10769 Published 2021-06-01 Fixed in 1.6.0 CWE-79
TI-2021-06611 CVE-2021-24319 · GHSA-c84c-76xv-wmp8

Bello < 1.6.0 - Authenticated Cross-Site Scripting (XSS) and XFS

Priority LOW 28

The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ page, leading to a Cross-Site Scr…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01681 Published 2021-06-01 Fixed in 1.6.0 CWE-79