{"uuid": "760b299e-ccb8-48c6-8ed7-83804dcabff1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24719", "type": "seen", "source": "https://t.me/hacking_Attack/28232", "content": "Exploit Collector\nWordPress Enfold Theme 4.8.3 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png \nWordPress Enfold theme version 4.8.3 suffers from a cross site scripting vulnerability.\n\nMD5 | d9d1878c1ba91b823f24f56e988af8c6\n\nDownload\n# Exploit Title: WordPress Theme Enfold 4.8.3 - Reflected Cross-Site Scripting (XSS)\n# Google Dork: \"inurl:avia-element-paging\"\n# Date: 18/10/2021\n# Exploit Author: Francisco D\u00edaz-Pache Alonso, Sergio Corral Cristo and David \u00c1lvarez Robles\n# Vendor Homepage: https://kriesi.at/\n# Version: Enfold < 4.8.4 (all versions)\n# Tested on: Ubuntu\n# CVE : CVE-2021-24719\n\n# Full disclosure and PoC on: https://blog.asturhackers.es/cross-site-scripting-xss-reflejado-en-tema-enfold-4-8-4-para-wordpress\n\nWhile navigating on WordPress sites with Enfold Theme previous than 4.8.4 version and Avia Page Builder, string \u201cProofOfConcept\u201d can be reflected literally  on pagination numbers. Moreover, the parameter \u201cavia-element-paging\u201d appears and can be used for crafting Google Dork based searches.\n\nhttps://[hostname]/[path]?ProofOfConcept --> This URL must include pages shown by Enfold theme\n\nChanging the \u201cProofOfConcept\u201d text with a Cross-Site-Scripting (XSS) payload, the page processes and executes it. This is a reflected Cross-Site-Scripting (XSS)  vulnerability. Find the following URL that includes the malicious payload.\n\nhttps://[hostname]/[path]/?%2527%253E%253Cscript%253Eeval%2528atob%2528%2522Y29uc29sZS5sb2coZG9j --> This URL must include pages shown by Enfold theme\n\nPayload (double encoded): this payload is double encoded in the URL from:\n'>\n\nPayload (base64): the \u201catob\u201d payload is Base64 encoded from:\nconsole.log(document.cookie)\n\nNavigating to the crafted URL, the console log displays some cookies that are used by the affected site (i.e. cookies with no \u201cHttpOnly\u201d flag set). However, the payload can be easily configurable.\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:13.040297Z"}