CVE-2021-24320

The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_listing_field_my_lat_default, bt_bb_listing_field_keyword, bt_bb_listing_field_location_autocomplete, bt_bb_listing_field_price_range_from and bt_bb_listing_field_price_range_to parameter in ints listing page, leading to reflected Cross-Site Scripting issues.

• CWE-79

• https://m0ze.ru/vulnerability/%5B2021-03-21%5D-%5BWordPress%5D-%5BCWE-79%5D-Bello-WordPress-Theme-v1.5.9.txtExploit, Third Party Advisory
• https://wpscan.com/vulnerability/6b5b42fd-028a-4405-b027-3266058029bbExploit, Third Party Advisory
• https://m0ze.ru/vulnerability/%5B2021-03-21%5D-%5BWordPress%5D-%5BCWE-79%5D-Bello-WordPress-Theme-v1.5.9.txtExploit, Third Party Advisory
• https://wpscan.com/vulnerability/6b5b42fd-028a-4405-b027-3266058029bbExploit, Third Party Advisory

Published

Jun 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-24315The GiveWP – Donation Plugin and Fundraising Platform WordPr…4.8
• CVE-2021-24316The search feature of the Mediumish WordPress theme through …6.1
• CVE-2021-24317The Listeo WordPress theme before 1.6.11 did not properly sa…6.1
• CVE-2021-24318The Listeo WordPress theme before 1.6.11 did not ensure that…6.5
• CVE-2021-24319The Bello - Directory & Listing WordPress theme before 1.6.0…5.4
• CVE-2021-2432Vulnerability in the Java SE product of Oracle Java SE (comp…3.7
• CVE-2021-24321The Bello - Directory & Listing WordPress theme before 1.6.0…9.8
• CVE-2021-24322The Database Backup for WordPress plugin before 2.4 did not …5.4
• CVE-2021-24323When taxes are enabled, the "Additional tax classes" field w…4.8
• CVE-2021-24324The 404 SEO Redirection WordPress plugin through 1.3 is lack…6.5
• CVE-2021-24325The tab parameter of the settings page of the 404 SEO Redire…6.1
• CVE-2021-24326The tab parameter of the settings page of the All 404 Redire…5.4