Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: BoostifyThemes Clear all filters
TI-2021-06589 CVE-2021-24297 · GHSA-g2fh-2pjf-f9ww

Goto < 2.1 - Reflected Cross-Site Scripting (XSS)

Priority LOW 29

The Goto WordPress theme before 2.1 did not properly sanitize the formvalue JSON POST parameter in its tl_filter AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00822 Published 2021-05-24 Fixed in 2.1 CWE-79
TI-2021-06606 CVE-2021-24314 · GHSA-w67x-r869-xc5q

Goto < 2.1 - Unauthenticated Blind SQL Injection

Priority MEDIUM 46

The Goto WordPress theme before 2.1 did not sanitise, validate of escape the keywords GET parameter from its listing page before using it in a SQL statement, leading to an Unauthenticated SQL injection issue

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0195 Published 2021-05-17 Fixed in 2.1 CWE-89
TI-2021-06527 CVE-2021-24235 · GHSA-wqqh-h744-mmw7

Goto - Tour & Travel < 2.0 - Unauthenticated Reflected XSS

Priority LOW 33

The Goto WordPress theme before 2.0 does not sanitise the keywords and start_date GET parameter on its Tour List page, leading to an unauthenticated reflected Cross-Site Scripting issue.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02914 Published 2021-04-22 Fixed in 2.0 CWE-79