{"id":"CVE-2022-2654","aliases":["EUVD-2022-34900","GHSA-mcf6-w793-99gq"],"status":"published","title":"Classima \u003c 2.1.11 - Reflected Cross-Site Scripting","description":"The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store \u0026 Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00632,"percentile":0.50632,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2022-09-16T08:40:31Z","modified":"2026-06-17T04:42:17Z","products":[{"vendor":"radiustheme","product":"classified_listing"},{"vendor":"radiustheme","product":"classified_listing_store_\\\u0026_membership"},{"vendor":"radiustheme","product":"classima"},{"vendor":"radiustheme","product":"classima_core"},{"vendor":"unknown","product":"classified listing pro - classified ads \u0026 business directory plugin"},{"vendor":"unknown","product":"classified listing store \u0026 membership addon"},{"vendor":"unknown","product":"classified listing – classified ads \u0026 business directory plugin"},{"vendor":"unknown","product":"classima"},{"vendor":"unknown","product":"classima core"}],"references":[{"url":"https://wpscan.com/vulnerability/845f44ca-f572-48d7-a19a-89cace0b8993","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2654"},{"url":"https://github.com/advisories/GHSA-mcf6-w793-99gq"}],"sources":{"cve":[{"id":"CVE-2022-2654","title":"Classima \u003c 2.1.11 - Reflected Cross-Site Scripting","description":"The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store \u0026 Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting","status":"published","published":"2022-09-16T08:40:31Z","modified":"2025-06-05T18:18:42.406Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:32.156873Z"}],"euvd":[{"id":"EUVD-2022-34900","description":"The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store \u0026 Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting","status":"published","published":"2022-09-16T08:40:31Z","modified":"2025-06-05T18:18:42Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:29.13667Z"}],"ghsa":[{"id":"GHSA-mcf6-w793-99gq","title":"The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing...","description":"The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store \u0026 Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting","status":"published","published":"2022-09-17T00:00:40Z","modified":"2023-01-29T05:03:28Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:45:19.964025Z"}],"nvd":[{"id":"CVE-2022-2654","description":"The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store \u0026 Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting","status":"published","published":"2022-09-16T09:15:10.727Z","modified":"2026-06-17T04:42:17.45Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:28.118799Z"}]}}