CVE-2020-8498

XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter

published January 30, 2020

CVSS
—
EPSS
1%
Percentile
68.2
In the wild
Unconfirmed
What it is

XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users (e.g., ones who have the publish_posts capability).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01211 · 68.2th percentile
Published
2020-01-30T22:52Z
EPSS history
Timeline
  • 30 JAN 22:52Z
    XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter
    cvelistv5