CVE-2020-36656

Published Feb 21, 2023

Last updated a year ago

CVSS medium 5.4

Overview

Description: The Spectra WordPress plugin before 1.15.0 does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks.
Source: contact@wpscan.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.4
Impact score: 2.7
Exploitability score: 2.3
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:brainstormforce:spectra:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4387B7DE-2859-46C2-97FB-250EDF414788",
            "versionEndExcluding": "1.15.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References