CVE-2020-15364

The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.

• CWE-79

• http://packetstormsecurity.com/files/158510/WordPress-NexosReal-Estate-Theme-1.7-Cross-Site-Scripting-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/vladvector/vladvector.github.io/blob/master/exploit/2020-06-17-nexos-real-estate-wordpress-theme-v1-7.txtExploit, Third Party Advisory
• https://themeforest.net/item/nexos-real-estate-agency-directory/21126242Product, Third Party Advisory
• http://packetstormsecurity.com/files/158510/WordPress-NexosReal-Estate-Theme-1.7-Cross-Site-Scripting-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/vladvector/vladvector.github.io/blob/master/exploit/2020-06-17-nexos-real-estate-wordpress-theme-v1-7.txtExploit, Third Party Advisory
• https://themeforest.net/item/nexos-real-estate-agency-directory/21126242Product, Third Party Advisory

Published

Jun 28, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15357Network Analysis functionality in Askey AP5100W_Dual_SIG_1.0…9.8
• CVE-2020-15358In SQLite before 3.32.3, select.c mishandles query-flattener…5.5
• CVE-2020-1536An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15360com.docker.vmnetd in Docker Desktop 2.3.0.3 allows privilege…7.8
• CVE-2020-15362wifiscanner.js in thingsSDK WiFi Scanner 1.0.1 allows Code I…9.8
• CVE-2020-15363The Nexos theme through 1.7 for WordPress allows side-map/?s…9.8
• CVE-2020-15365LibRaw before 0.20-Beta3 has an out-of-bounds write in parse…6.5
• CVE-2020-15366An issue was discovered in ajv.validate() in Ajv (aka Anothe…5.6
• CVE-2020-15367Venki Supravizio BPM 10.1.2 does not limit the number of aut…9.8
• CVE-2020-15368AsrDrv103.sys in the ASRock RGB Driver does not properly res…5.5
• CVE-2020-15369Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through…8.8
• CVE-2020-1537An elevation of privilege vulnerability exists when the Wind…7.8