Vulnerability · Published Jan 30, 2020 · Assigned by mitre
CVE-2020-8498
Medium 5.4
In plain English
A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Severity (CVSS NVD)5.4Medium
Exploit odds (30 days)1.2%top 31.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users (e.g., ones who have the publish_posts capability).
Affected products (as reported)
References
- https://github.com/bradyvercher/gistpress/commit/e3f260edb6673227b0471c74b7ab13c094411ef7 x_refsource_MISC
- https://github.com/bradyvercher/gistpress/releases/tag/v3.0.2 x_refsource_MISC
- https://wpvulndb.com/vulnerabilities/10053 x_refsource_MISC