CVE-2020-13643

An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress

High · published May 28, 2020

CVSS v3.0
8.8
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The live_editor_panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R
CVSS v4.0
Not supplied
EPSS
0.00809 · 56.4th percentile
Published
2020-05-28T03:11Z
EPSS history
Timeline
  • 28 MAY 03:11Z
    An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress
    cvelistv5