CVE-2020-11030

MEDIUM severity · CVSS 6.4 · CWE-707

6.4CVSS MEDIUM

Summary

In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

Confidentiality impactLow

Integrity impactLow

Availability impactNone

Exploit probability (EPSS)1%

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Affected products we track (1)

WordPress

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updatesAdvisory
https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updatesAdvisory
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-vccm-6gmc-qhjhAdvisory
https://www.debian.org/security/2020/dsa-4677Advisory
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-vccm-6gmc-qhjhAdvisory
https://www.debian.org/security/2020/dsa-4677Advisory