What this actually is.
Technical background, root cause, and affected surface.
The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS.
- Vendor
- Thembay
- Affected Product
- Greenmart version 2.4.2.
- CVE
- CVE-2020-16140
- Securin ID
- 2020-CSW-07-1045
- Status
- Fixed
- Date
- July 17, 2020
- Severity
- Medium
- CVSS Score
- 6.1
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CWE
- CWE-79
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The following vulnerability was tested on the Greenmart theme on WordPress with version 5.4.2.
Figure-07: Wp-config configuration related to protecting XSS.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
When the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content. This means that an attacker has to send a crafted malicious URL or post form to the victim to insert the payload.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Download and apply the relevant patches from the vendor:
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Reported to Vendor
Vendor Responded
Vendor Released Fixed
CVE Assigned
Disclosed 1 day after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.