CVE-2020-11025
Authenticated cross-site scripting (XSS) in WordPress Customizer
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 5.8EPSS 1.5%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Lifecycle
30 Apr 2020Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Affected products
WordPress · WordPressWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →