Description
The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store & Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Classified Listing – Classified ads & Business Directory Plugin | 2.2.14 – < 2.2.14 | 2.2.14 |
| — | Classified Listing Pro - Classified ads & Business Directory Plugin | 2.0.20 – < 2.0.20 | 2.0.20 |
| — | Classified Listing Store & Membership Addon | 1.4.20 – < 1.4.20 | 1.4.20 |
| — | Classima Core | 1.10 – < 1.10 | 1.10 |
| — | Classima | 2.1.11 – < 2.1.11 | 2.1.11 |