.. / CVE-2021-24320

• XSS
• Nuclei
• Web

Exploit for WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting (CVE-2021-24320)

Description:

WordPress Bello Directory & Listing theme before 1.6.0 contains a reflected cross-site scripting vulnerability. It does not properly sanitize and escape the listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_listing_field_my_lat_default, bt_bb_listing_field_keyword, bt_bb_listing_field_location_autocomplete, bt_bb_listing_field_price_range_from and bt_bb_listing_field_price_range_to parameters in the ints listing page.

Nuclei Template

View the template here CVE-2021-24320.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-24320.yaml

References: