CVE-2023-2813 [Medium] | XSS in Connections Reloaded

All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2, BunnyPressLite WordPress theme before 2.1, Cafe Bistro WordPress theme before 1.1.4, College WordPress theme before 1.5.1, Connections Reloaded WordPress theme through 3.1, Counterpoint WordPress theme through 1.8.1, Digitally WordPress theme through 1.0.8, Directory WordPress theme before 3.0.2, Drop WordPress theme before 1.22, Everse WordPress theme before 1.2.4, Fashionable Store WordPress theme through 1.3.4, Fullbase WordPress theme before 1.2.1, Ilex WordPress theme before 1.4.2, Js O3 Lite WordPress theme through 1.5.8.2, Js Paper WordPress theme through 2.5.7, Kata WordPress theme before 1.2.9, Kata App WordPress theme through 1.0.5, Kata Business WordPress theme through 1.0.2, Looki Lite WordPress theme before 1.3.0, moseter WordPress theme through 1.3.1, Nokke WordPress theme before 1.2.4, Nothing Personal WordPress theme through 1.0.7, Offset Writing WordPress theme through 1.2, Opor Ayam WordPress theme through 18, Pinzolo WordPress theme before 1.2.10, Plato WordPress theme before 1.1.9, Polka Dots WordPress theme through 1.2, Purity Of Soul WordPress theme through 1.9, Restaurant PT WordPress theme before 1.1.3, Saul WordPress theme before 1.1.0, Sean Lite WordPress theme before 1.4.6, Tantyyellow WordPress theme through 1.0.0.5, TIJAJI WordPress theme through 1.43, Tiki Time WordPress theme through 1.3, Tuaug4 WordPress theme through 1.4, Tydskrif WordPress theme through 1.1.3, UltraLight WordPress theme through 1.2, Venice Lite WordPress theme before 1.5.5, Viala WordPress theme through 1.3.1, viburno WordPress theme before 1.3.2, Wedding Bride WordPress theme before 1.0.2, Wlow WordPress theme before 1.2.7 suffer from the same issue about the search box reflecting the results causing XSS which allows an unauthenticated attacker to exploit against users if they click a malicious link.

EDB-ID	Source	Kind	Published	Link
—	nvd_ref	exploit_tag		Exploit-DB ↗

EDB-ID

Source

Kind

Published

Link

—

nvd_ref

exploit_tag

Exploit-DB ↗

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-05-30	2.24%	2.55%	+0.30%
2	2026-03-04	3.10%	2.24%	-0.85%
3	2026-03-01	—	3.10%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-05-30

2.24%

2.55%

+0.30%

2026-03-04

3.10%

2.24%

-0.85%

2026-03-01

—

3.10%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
6.1	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:N) Service keeps running; no real outage angle.	2.8	2.7	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

6.1

3.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R): A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:C): Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:L): Attackers could change some data, but it’s limited—not everything goes.
Availability (A:N): Service keeps running; no real outage angle.

2.8

2.7

[email protected]

Affected software / configurations for CVE-2023-2813

Vendor	Product	Version	Raw CPE
ajaydsouza	connections_reloaded	<= 3.1	cpe:2.3:a:ajaydsouza:connections_reloaded::::::wordpress::*
archimidismertzanos	atlast_business	<= 1.5.8.5	cpe:2.3:a:archimidismertzanos:atlast_business::::::wordpress::*
archimidismertzanos	fashionable_store	<= 1.3.4	cpe:2.3:a:archimidismertzanos:fashionable_store::::::wordpress::*
archimidismertzanos	nothing_personal	<= 1.0.7	cpe:2.3:a:archimidismertzanos:nothing_personal::::::wordpress::*
arthousewebdesign	brain_power	<= 1.2	cpe:2.3:a:arthousewebdesign:brain_power::::::wordpress::*
asmedia	moseter	<= 1.3.1	cpe:2.3:a:asmedia:moseter::::::wordpress::*
asmedia	tuaug4	<= 1.4	cpe:2.3:a:asmedia:tuaug4::::::wordpress::*
ayecode	cafe_bistro	< 1.1.4	cpe:2.3:a:ayecode:cafe_bistro::::::wordpress::*
ayecode	college	< 1.5.1	cpe:2.3:a:ayecode:college::::::wordpress::*
ayecode	directory	< 3.0.2	cpe:2.3:a:ayecode:directory::::::wordpress::*
ayecode	plato	< 1.1.9	cpe:2.3:a:ayecode:plato::::::wordpress::*
ayecode	restaurant_pt	< 1.1.3	cpe:2.3:a:ayecode:restaurant_pt::::::wordpress::*
ayecode	wedding_bride	< 1.0.2	cpe:2.3:a:ayecode:wedding_bride::::::wordpress::*
climaxthemes	kata	< 1.2.9	cpe:2.3:a:climaxthemes:kata::::::wordpress::*
competethemes	drop	< 1.22	cpe:2.3:a:competethemes:drop::::::wordpress::*
davidgarlitz	viala	<= 1.3.1	cpe:2.3:a:davidgarlitz:viala::::::wordpress::*
deothemes	arendelle	< 1.1.13	cpe:2.3:a:deothemes:arendelle::::::wordpress::*
deothemes	everse	< 1.2.4	cpe:2.3:a:deothemes:everse::::::wordpress::*
deothemes	nokke	< 1.2.4	cpe:2.3:a:deothemes:nokke::::::wordpress::*
dotecsa	ilex	< 1.4.2	cpe:2.3:a:dotecsa:ilex::::::wordpress::*
dotecsa	viburno	< 1.3.2	cpe:2.3:a:dotecsa:viburno::::::wordpress::*
fredriksoerlie	ultralight	<= 1.2	cpe:2.3:a:fredriksoerlie:ultralight::::::wordpress::*
fyrewurks	polka_dots	<= 1.2	cpe:2.3:a:fyrewurks:polka_dots::::::wordpress::*
fyrewurks	tiki_time	<= 1.3	cpe:2.3:a:fyrewurks:tiki_time::::::wordpress::*
henleythemes	counterpoint	<= 1.8.1	cpe:2.3:a:henleythemes:counterpoint::::::wordpress::*
iznyn	opor_ayam	<= 1.8	cpe:2.3:a:iznyn:opor_ayam::::::wordpress::*
iznyn	purity_of_soul	<= 1.9	cpe:2.3:a:iznyn:purity_of_soul::::::wordpress::*
jinwen	js_o3_lite	<= 1.5.8.2	cpe:2.3:a:jinwen:js_o3_lite::::::wordpress::*
jinwen	js_paper	<= 2.5.7	cpe:2.3:a:jinwen:js_paper::::::wordpress::*
marchettidesign	fullbase	< 1.2.1	cpe:2.3:a:marchettidesign:fullbase::::::wordpress::*
marchettidesign	wlow	< 1.2.7	cpe:2.3:a:marchettidesign:wlow::::::wordpress::*
omarfolgheraiter	digitally	<= 1.0.8	cpe:2.3:a:omarfolgheraiter:digitally::::::wordpress::*
saumendra	aapna	<= 1.3	cpe:2.3:a:saumendra:aapna::::::wordpress::*
saumendra	anand	<= 1.2	cpe:2.3:a:saumendra:anand::::::wordpress::*
ta2g	tantyyellow	<= 1.0.0.5	cpe:2.3:a:ta2g:tantyyellow::::::wordpress::*
themeinprogress	bazaar_lite	< 1.8.6	cpe:2.3:a:themeinprogress:bazaar_lite::::::wordpress::*
themeinprogress	looki_lite	< 1.3.0	cpe:2.3:a:themeinprogress:looki_lite::::::wordpress::*
themeinprogress	saul	< 1.1.0	cpe:2.3:a:themeinprogress:saul::::::wordpress::*
themeinprogress	saul_lite	< 1.4.6	cpe:2.3:a:themeinprogress:saul_lite::::::wordpress::*
themeinprogress	venice_lite	<= 1.5.5	cpe:2.3:a:themeinprogress:venice_lite::::::wordpress::*
thewebhunter	anfaust	<= 1.1	cpe:2.3:a:thewebhunter:anfaust::::::wordpress::*
thewebhunter	offset_writing	<= 1.2	cpe:2.3:a:thewebhunter:offset_writing::::::wordpress::*
thriveweb	pinzolo	< 1.2.10	cpe:2.3:a:thriveweb:pinzolo::::::wordpress::*
tijaji	tijaji	<= 1.43	cpe:2.3:a:tijaji:tijaji::::::wordpress::*
wpmole	tydskrif	<= 1.1.3	cpe:2.3:a:wpmole:tydskrif::::::wordpress::*
yws	bunnypress_lite	<= 2.1	cpe:2.3:a:yws:bunnypress_lite::::::wordpress::*

References for CVE-2023-2813

URL	Tags
https://wpscan.com/vulnerability/f434afd3-7de4-4bf4-a9bb-9f9aeaae1dc5	Exploit Third Party Advisory

URL

CVE-2023-2813 | Multiple Themes - Reflected XSS

Public exploit references (Exploit-DB) for CVE-2023-2813

Exploit prediction scoring system (EPSS) score for CVE-2023-2813

Common vulnerability scoring system (CVSS) metrics for CVE-2023-2813

Weakness enumeration for CVE-2023-2813

Affected software / configurations for CVE-2023-2813

References for CVE-2023-2813