Vulnerabilities > Purethemes > Listeo > 1.2.7
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-06-01 | CVE-2021-24317 | Cross-site Scripting vulnerability in Purethemes Listeo The Listeo WordPress theme before 1.6.11 did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues | 4.3 |
| 2021-06-01 | CVE-2021-24318 | Authorization Bypass Through User-Controlled Key vulnerability in Purethemes Listeo The Listeo WordPress theme before 1.6.11 did not ensure that the Post/Page and Booking to delete belong to the user making the request, allowing any authenticated users to delete arbitrary page/post and booking via an IDOR vector. | 6.5 |