CVE-2019-20211

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing Address, Listing Latitude, Listing Longitude, Email Address, Description, Name, Job or Position, Description, Service Name, Address, Latitude, Longitude, Phone Number, or Website.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cxsecurity.com/issue/WLB-2019120110Exploit, Third Party Advisory
https://cxsecurity.com/issue/WLB-2019120111Exploit, Third Party Advisory
https://cxsecurity.com/issue/WLB-2019120112Exploit, Third Party Advisory
https://themeforest.net/item/citybook-directory-listing-wordpress-theme/21694727Third Party Advisory
https://themeforest.net/item/easybook-directory-listing-wordpress-theme/23206622Third Party Advisory
https://themeforest.net/item/townhub-directory-listing-wordpress-theme/25019571Third Party Advisory
https://wpvulndb.com/vulnerabilities/10013Third Party Advisory
https://wpvulndb.com/vulnerabilities/10014Third Party Advisory
https://wpvulndb.com/vulnerabilities/10018Third Party Advisory
https://cxsecurity.com/issue/WLB-2019120110Exploit, Third Party Advisory
https://cxsecurity.com/issue/WLB-2019120111Exploit, Third Party Advisory
https://cxsecurity.com/issue/WLB-2019120112Exploit, Third Party Advisory
https://themeforest.net/item/citybook-directory-listing-wordpress-theme/21694727Third Party Advisory
https://themeforest.net/item/easybook-directory-listing-wordpress-theme/23206622Third Party Advisory
https://themeforest.net/item/townhub-directory-listing-wordpress-theme/25019571Third Party Advisory
https://wpvulndb.com/vulnerabilities/10013Third Party Advisory
https://wpvulndb.com/vulnerabilities/10014Third Party Advisory
https://wpvulndb.com/vulnerabilities/10018Third Party Advisory

Timeline

Published: Jan 13, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-202126.1The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat CVE-2019-202137.5D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrate CVE-2019-202159.8D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in CVE-2019-202169.8D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method i CVE-2019-202179.8D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method i CVE-2019-202187.5selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.CVE-2019-202198.8ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor in ngiflib.c.CVE-2019-20226.5In rw_t3t_act_handle_fmt_rsp and rw_t3t_act_handle_sro_rsp of rw_t3t.cc, there is a possible out-of-bound read due to a missing bounds check CVE-2019-202206.1In Support Incident Tracker (SiT!) 3.67, the search_id parameter in the search_incidents_advanced.php page is affected by XSS.CVE-2019-202216.1In Support Incident Tracker (SiT!) 3.67, Load Plugins input in the config.php page is affected by XSS. The XSS payload is, for example, exec CVE-2019-202226.1In Support Incident Tracker (SiT!) 3.67, the Short Application Name and Application Name inputs in the config.php page are affected by XSS.CVE-2019-202236.1In Support Incident Tracker (SiT!) 3.67, the id parameter is affected by XSS on all endpoints that use this parameter, a related issue to CV