Medium severity6.1NVD Advisory· Published Jul 18, 2023· Updated Jun 17, 2026

CVE-2023-3708

Description

Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Deothemes/Amela
cpe:2.3:a:deothemes:amela:*:*:*:*:*:wordpress:*:*
Range: <1.0.14
Deothemes/Arendelle
cpe:2.3:a:deothemes:arendelle:*:*:*:*:*:wordpress:*:*
Range: <1.1.13
Deothemes/Everse
cpe:2.3:a:deothemes:everse:*:*:*:*:*:wordpress:*:*
Range: <1.8.12
Deothemes/Medikaid
cpe:2.3:a:deothemes:medikaid:*:*:*:*:*:wordpress:*:*
Range: <1.1.3
Deothemes/Nokke
cpe:2.3:a:deothemes:nokke:*:*:*:*:*:wordpress:*:*
Range: <1.2.4
WordPress/DeoThemesllm-create

Patches

Vulnerability mechanics

References

themes.trac.wordpress.org/changesetnvdPatch
themes.trac.wordpress.org/changesetnvdPatch
themes.trac.wordpress.org/changesetnvdPatch
themes.trac.wordpress.org/changesetnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/1b8b0f14-f31a-45cd-bb98-0b717059aa80nvdThird Party Advisory
deothemes.com/changelog/medikaid-changelog/nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000