CVE-2023-49839: Klbtheme Bacola Theme Core Plugin

High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Cosmetsy theme (core plugin), KlbTheme Partdo theme (core plugin), KlbTheme Bacola theme (core plugin), KlbTheme Medibazar theme (core plugin), KlbTheme Furnob theme (core plugin), KlbTheme Clotya theme (core plugin) allows Reflected XSS.This issue affects Cosmetsy theme (core plugin): from n/a through 1.3.0; Partdo theme (core plugin): from n/a through 1.0.9; Bacola theme (core plugin): from n/a through 1.3.3; Medibazar theme (core plugin): from n/a through 1.2.3; Furnob theme (core plugin): from n/a through 1.1.7; Clotya theme (core plugin): from n/a through 1.1.5.

Affected products

• Klbtheme Bacola Theme Core Plugin: up to and including 1.3.3
• Klbtheme Clotya Theme Core Plugin: up to and including 1.1.5
• Klbtheme Cosmetsy Theme Core Plugin: up to and including 1.3.0
• Klbtheme Furnob Theme Core Plugin: up to and including 1.1.7
• Klbtheme Medibazar Theme Core Plugin: up to and including 1.2.3
• Klbtheme Partdo Theme Core Plugin: up to and including 1.0.9

Published 2024-03-26. Last modified 2026-06-17.