WordPress Avante theme < 3.0.5 - Reflected Cross Site Scripting (XSS) vulnerability

Description

Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions.

Vendor	Product	Versions
themegoods	avante	n/a, 3.0.4

Tier C

VulDB26d ago

→ No new info (linked only)

CVSS 3.17.1 MEDIUM

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CISA KEV❌ No

Actively exploited❌ No

Patch available

3.0.5

CWECWE-79

PublishedJun 17, 2026

Last enriched26d agov2

Trending Score1

Source articles1

Independent1

Info Completeness9/14

Missing: epss, kev, exploit, iocs, mitre_attack

Last enriched 26d ago

v2Tier C26d ago

Updated vendor to meGoods, product to Avante Plugin, affected versions to 3.0.4, severity to MEDIUM, and noted no available exploit.

affectedVersionsseverity

via VulDB

v126d ago

Initial creation