VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Jul 18, 2023· Updated Apr 8, 2026

CVE-2023-3708

CVE-2023-3708

Description

Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affected products

5
  • Deothemes/Amela
    cpe:2.3:a:deothemes:amela:*:*:*:*:*:wordpress:*:*
    Range: <1.0.14
  • Deothemes/Arendelle
    cpe:2.3:a:deothemes:arendelle:*:*:*:*:*:wordpress:*:*
    Range: <1.1.13
  • Deothemes/Everse
    cpe:2.3:a:deothemes:everse:*:*:*:*:*:wordpress:*:*
    Range: <1.8.12
  • Deothemes/Medikaid
    cpe:2.3:a:deothemes:medikaid:*:*:*:*:*:wordpress:*:*
    Range: <1.1.3
  • Deothemes/Nokke
    cpe:2.3:a:deothemes:nokke:*:*:*:*:*:wordpress:*:*
    Range: <1.2.4

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.