CVE-2020-11025CWE-79

Authenticated cross-site scripting (XSS) in WordPress Customizer

Medium · published April 30, 2020

CVSS v3.1
5.8
EPSS
2%
Percentile
74.5
In the wild
Unconfirmed
What it is

In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01526 · 74.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-04-30T22:10Z
EPSS history
Timeline
  • 30 APR 22:10Z
    Authenticated cross-site scripting (XSS) in WordPress Customizer
    cvelistv5