CVE-2020-35936

Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts…

High · published January 1, 2021

CVSS v3.1
7.5
EPSS
2%
Percentile
76.6
In the wild
Unconfirmed
What it is

Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.01671 · 76.6th percentile
Published
2021-01-01T01:25Z
EPSS history
Timeline
  • 01 JAN 01:25Z
    Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts…
    cvelistv5