Description

WordPress Theme OneTone is prone to an unauthenticated Stored Cross-Site Scripting vulnerability in version 3.0.6 and below.

Remediation

Remove the theme from your WordPress installation.

References

Vulnerability Information at wpvulndb.com

Unauthenticated stored XSS vulnerability in WordPress OneTone theme

OneTone Vulnerability Leads to JavaScript Cookie Hijacking

Related Vulnerabilities

WordPress Plugin WP Statistics Cross-Site Scripting (12.6.7)

WordPress Plugin SMTP Mail Cross-Site Scripting (1.3.1)

HTML Injection

WordPress Plugin GS Books Showcase Cross-Site Scripting (1.3.0)

WordPress Plugin WPML (WordPress Multilingual) Multiple Vulnerabilities (3.1.8.6)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

XSS CWE-79 CVE-2019-17230 CVE-2019-17231