Until we fix these, they have ‘decertified’ us. I am at a loss since I am not a coder and did not know if this is a theme related issue.

Do you have any fixes for this?
Thanks very much. You have been very helpful, recently with A Fortuna Revolution slider problem. You found and fixed it! Thanks you, Kal.

Best,
Elaine

Where exactly is the XSS here?
Could it be that the actual scripting is stripped here in the forum? May you use the CODE html button to wrap your code?

HI there. I’m sorry I am not more help but these are the only 3 URLs Sitelock gave me that show whatever it is they are flagging. I’m not sure what or where the actual code is that generates these URLs.

I am not even sure if this is related to the Savia theme search functions.
Sorry I can not be more help but I am trying to solve the issue for the client.

Thank you….

I am not sure I understand, the theme implements a custom search.php template, but it uses the core $query_string variable for searching that is internally sanitized, so no XSS should be possible here… ?

The SiteLock scan showed up XSS vulnerability. We tried to explore the causes and looked for a fix on our own. We found out that the Savia theme shows the unfiltered searching-text in title section, so it’s possible to enter and execute javascript code on the page. We managed to open a pop-up notification through our search field! Only workaround was to disable the search. Afterwards, SiteLock scan succeeded (@BigWorld perhaps an option for you, too…)

However, we liked the search very much and want to have it back Can you offer any fix for this bug in future updates? In our opinion, this problem also bothers many other users.

Thanks!

https://www.neogramm.de/?s=%3C/title%3E%3Cscript%20language=%22javscript%22%20type=%22text/javascript%22%3Ealert%28%27This%20javascript%20could%20do%20anything!%27%29;%3C/script%3E

In Firefox, with search field enabled, Javascript is opening a pop up window.

Also described here: https://wordpress.org/support/topic/xss-vulnerability-1

The issue is actually in the header.php, please replace this line:

printf( __('Search: %s','Savia'), get_query_var('s') );

with this:

printf( __('Search: %s','Savia'), strip_tags(get_query_var('s')) );