CVE-2020-24314

Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag

published August 26, 2020

CVSS
—
EPSS
1%
Percentile
58.3
In the wild
Unconfirmed
What it is

Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00866 · 58.3th percentile
Published
2020-08-26T12:59Z
EPSS history
Timeline
  • 26 AUG 12:59Z
    Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag
    cvelistv5