CVE-2020-11025

MEDIUM severity · CVSS 5.8 · Cross-site scripting (XSS)

5.8CVSS MEDIUM

Summary

In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

Impact & exploitability

Attack vectorNetwork

Attack complexityHigh

Privileges requiredLow

User interactionRequired

Confidentiality impactHigh

Integrity impactNone

Availability impactNone

Exploit probability (EPSS)1%

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

Affected products we track (1)

WordPress

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updatesAdvisory
https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updatesAdvisory
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4mhg-j6fx-5g3cAdvisory
https://www.debian.org/security/2020/dsa-4677Advisory
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4mhg-j6fx-5g3cAdvisory
https://www.debian.org/security/2020/dsa-4677Advisory