What’s Vulnerable › Vulnerabilities

CVE-2021-24335: Car Repair Services < 4.0 - Unauthenticated Reflected XSS & XFS

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-01 · updated 2026-06-17
• Weakness: CWE-79

Description

The Car Repair Services & Auto Mechanic WordPress theme before 4.0 did not properly sanitise its serviceestimatekey search parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue

Affected products

• Car Repair Services & Auto Mechanic: before 4.0 — fixed in 4.0

How to fix

Upgrade to a fixed version: Car Repair Services & Auto Mechanic 4.0. Check the vendor advisory for mitigations.

References

• https://m0ze.ru/vulnerability/%5B2021-02-12%5D-%5BWordPress%5D-%5BCWE-79%5D-Car-Repair-Services-WordPress-Theme-v3.9.txt
• https://themeforest.net/item/car-repair-services-auto-mechanic-wordpress-theme/19823557
• https://wpscan.com/vulnerability/39258aba-2449-4214-a490-b8e46945117d
• https://m0ze.ru/vulnerability/%5B2021-02-12%5D-%5BWordPress%5D-%5BCWE-79%5D-Car-Repair-Services-WordPress-Theme-v3.9.txt
• https://themeforest.net/item/car-repair-services-auto-mechanic-wordpress-theme/19823557
• https://wpscan.com/vulnerability/39258aba-2449-4214-a490-b8e46945117d

Get alerted when CVE-2021-24335 or the next vulnerability affects your stack