Reflected Cross-Site Scripting vulnerability in multiple WordPress components by KlbTheme
Summary
| CVE | CVE-2023-49839 |
|---|---|
| State | PUBLISHED |
| Assigner | Patchstack |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-03-26 08:15:35 UTC |
| Updated | 2026-04-28 19:22:29 UTC |
| Description | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Cosmetsy theme (core plugin), KlbTheme Partdo theme (core plugin), KlbTheme Bacola theme (core plugin), KlbTheme Medibazar theme (core plugin), KlbTheme Furnob theme (core plugin), KlbTheme Clotya theme (core plugin) allows Reflected XSS.This issue affects Cosmetsy theme (core plugin): from n/a through 1.3.0; Partdo theme (core plugin): from n/a through 1.0.9; Bacola theme (core plugin): from n/a through 1.3.3; Medibazar theme (core plugin): from n/a through 1.2.3; Furnob theme (core plugin): from n/a through 1.1.7; Clotya theme (core plugin): from n/a through 1.1.5. |
Risk And Classification
Primary CVSS: v3.1 7.1 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS: 0.002070000 probability, percentile 0.428990000 (date 2026-04-28)
Problem Types: CWE-79 | CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
| 3.1 | CNA | CVSS | 7.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
ChangedConfidentiality
LowIntegrity
LowAvailability
LowCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | KlbTheme | Cosmetsy Theme Core Plugin | affected n/a 1.3.0 custom | Not specified |
| CNA | KlbTheme | Partdo Theme Core Plugin | affected n/a 1.0.9 custom | Not specified |
| CNA | KlbTheme | Bacola Theme Core Plugin | affected n/a 1.3.3 custom | Not specified |
| CNA | KlbTheme | Medibazar Theme Core Plugin | affected n/a 1.2.3 custom | Not specified |
| CNA | KlbTheme | Furnob Theme Core Plugin | affected n/a 1.1.7 custom | Not specified |
| CNA | KlbTheme | Clotya Theme Core Plugin | affected n/a 1.1.5 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| patchstack.com/database/vulnerability/bacola-core/wordpress-bacola-core-plug... | af854a3a-2127-422b-91ae-364da2661108 | patchstack.com | |
| patchstack.com/database/vulnerability/clotya-core/wordpress-clotya-core-plug... | af854a3a-2127-422b-91ae-364da2661108 | patchstack.com | |
| patchstack.com/database/vulnerability/medibazar-core/wordpress-medibazar-cor... | af854a3a-2127-422b-91ae-364da2661108 | patchstack.com | |
| patchstack.com/database/vulnerability/furnob-core/wordpress-furnob-core-plug... | af854a3a-2127-422b-91ae-364da2661108 | patchstack.com | |
| patchstack.com/database/vulnerability/cosmetsy-core/wordpress-cosmetsy-core-... | af854a3a-2127-422b-91ae-364da2661108 | patchstack.com | |
| patchstack.com/database/vulnerability/partdo-core/wordpress-partdo-core-plug... | af854a3a-2127-422b-91ae-364da2661108 | patchstack.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: FearZzZz (Patchstack Alliance) (en)
There are currently no legacy QID mappings associated with this CVE.