CVE-2020-14063

Опубликовано: 21 июл. 2020

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. This is displayed in the page footer of every front-end page and executed in the browser of visitors.

Ссылки

https://wordpress.org/plugins/tc-custom-javascript/#developers
Release Notes
Third Party Advisory
https://www.wordfence.com/blog/2020/07/high-severity-vulnerability-patched-in-tc-custom-javascript/
Exploit
Third Party Advisory
https://wordpress.org/plugins/tc-custom-javascript/#developers
Release Notes
Third Party Advisory
https://www.wordfence.com/blog/2020/07/high-severity-vulnerability-patched-in-tc-custom-javascript/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:tc_custom_javascript_project:tc_custom_javascript:*:*:*:*:*:wordpress:*:*

Версия до 1.2.2 (исключая)

EPSS

Процентиль: 69%

0.00604

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-vqj7-7v57-m3xh

github

больше 3 лет назад