Nexos Vulnerabilities

The Nexos - Real Estate WordPress Theme theme for WordPress is vulnerable to generic SQL Injection via the ‘search_order’ parameter in versions up to, and including, 1.7 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVSS:

9.8

Affected:

up to 1.7

Fixed in:

1.8

Disclosed:

Jun 28, 2020

The Nexos - Real Estate theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_location’ parameter in versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVSS:

6.1

Affected:

up to 1.7

Fixed in:

1.8

Disclosed:

Jun 28, 2020

[en] The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection.

Affected:

up to 1.7

Fixed in:

1.7

Disclosed:

Jun 28, 2020

CVE-2020-15363 on NVD →

[en] The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.

Affected:

up to 1.8

Fixed in:

1.8

Disclosed:

Jun 28, 2020

CVE-2020-15364 on NVD →

Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered by m0ze in WordPress Nexos premium theme (versions <= 1.7).

Affected:

up to 1.8

Fixed in:

1.8

Disclosed:

Jun 28, 2020

SQL Injection (SQLi) vulnerability discovered by m0ze in WordPress Nexos premium theme (versions <= 1.7).

Affected:

up to 1.8

Fixed in:

1.8

Disclosed:

Jun 28, 2020

The Nexos - Real Estate theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_location’ parameter in versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

Affected:

up to 1.8

Fixed in:

1.8

Disclosed:

Jun 28, 2020

The Nexos - Real Estate WordPress Theme theme for WordPress is vulnerable to generic SQL Injection via the ‘search_order’ parameter in versions up to, and including, 1.7 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

Affected:

up to 1.8

Fixed in:

1.8

Disclosed:

Jun 28, 2020

The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection.

CVSS:

9.8

Affected:

up to 1.8

Fixed in:

1.8

Disclosed:

Jun 17, 2020

CVE-2020-15363 on NVD →

The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.

CVSS:

6.1

Affected:

up to 1.8

Fixed in:

1.8

Disclosed:

Jun 17, 2020

CVE-2020-15364 on NVD →

----[]- SQL Injection: -[]---- Vulnerable &#039;id&#039; parameter is https://listing-themes.com/nexos-wp/wp-admin/admin.php?page=ownlisting_addlisting&amp;id=8 ----[]- Persistent XSS: -[]---- You need a new user account, then go to any property listing on the website and use &laquo;ENQUIRY FORM&raquo; on the righ...

Affected:

up to 1.6.1

Fixed in:

1.6.1