CVE-2020-15364: 
WordPress vulnerability analysis and mitigation

The Nexos theme through version 1.7 for WordPress contains a reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2020-15364. The vulnerability was discovered in June 2020 and affects the top-map/?search_location= parameter. The issue was fixed with the release of version 1.8 on June 19th, 2020 (WPScan, MITRE).

The vulnerability exists in the search functionality of the Nexos Real Estate WordPress theme, specifically in the top-map/?search_location= parameter which fails to properly sanitize user input. This allows attackers to inject malicious scripts through the search parameter. The vulnerability has been assigned CVE-2020-15364 and affects all versions of the theme up to and including version 1.7 (WPScan).

The reflected XSS vulnerability allows attackers to execute arbitrary JavaScript code in the context of other users' browsers who visit the specially crafted URL. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks (WPScan).

The vulnerability is relatively easy to exploit as it requires no authentication and can be triggered by simply sending a specially crafted URL to potential victims. A proof of concept exists demonstrating the exploitation through the top-map/?search_location parameter (WPScan).

The recommended mitigation is to upgrade the Nexos theme to version 1.8 or later, which contains the fix for this vulnerability. The update was released on June 19th, 2020 (WPScan, Trustwave).