Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-20141: Laborator Neon theme can run malicious code via search suggestions

CVE-2019-20141 · published 6 years ago

Summary

The Laborator Neon theme version 2.0 for WordPress does not properly clean the data sent to its autosuggest feature, allowing attackers to inject harmful scripts. When a victim views the affected suggestion list, the malicious code can execute in their browser, potentially stealing information or taking control of their session. Apply the latest theme update or disable/validate the autosuggest function until a fix is available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
laborator	neon	2.0 `cpe:2.3:a:laborator:neon:2.0:::::wordpress::`

Original advisory text

An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.

References

https://knassar702.github.io/cve/neon/ Broken Link
https://knassar7o2.blogspot.com/2019/12/neon-dashboard-xss-reflected.html Broken Link Exploit Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

5% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published30 Dec 2019

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2019-20141 · NVD

Track software like this

Free during beta