漏洞描述
WordPress Car Repair Services & Auto Mechanic before 4.0 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the serviceestimatekey parameter before outputting it back in the page.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
themeforest.nethttps://themeforest.net/item/car-repair-services-auto-mechanic-wordpress-theme/19823557↗m0ze.ruhttps://m0ze.ru/vulnerability/[2021-02-12]-[WordPress]-[CWE-79]-Car-Repair-Services-WordPress-Theme-v3.9.txt↗wpscan.comhttps://wpscan.com/vulnerability/39258aba-2449-4214-a490-b8e46945117d↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-24335↗m0ze.ruhttps://m0ze.ru/vulnerability/%5B2021-02-12%5D-%5BWordPress%5D-%5BCWE-79%5D-Car-Repair-Services-WordPress-Theme-v3.9.txt↗