CVE-2022-3209

The soledad WordPress theme before 8.2.5 does not sanitise the {id,datafilter[type],...} parameters in its penci_more_slist_post_ajax AJAX action, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

Score

CVSS 3.1 6.1 Medium

Status

Modified - contact@wpscan.com

Published

2022-10-10

Last modified

2024-08-03

Weaknesses

CWE-79

Affected products

• Soledad (Pencidesign)
• Soledad (Unknown)

References

• https://wpscan.com/vulnerability/7a244fb1-fa0b-4294-9b51-588bf5d673a2