CVE-2020-13642

An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress

High · published May 28, 2020

CVSS v3.0
8.8
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R
CVSS v4.0
Not supplied
EPSS
0.00809 · 56.4th percentile
Published
2020-05-28T03:11Z
EPSS history
Timeline
  • 28 MAY 03:11Z
    An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress
    cvelistv5