PT-2020-20178 · WordPress · Gistpress

Published 2020-01-30 · Updated 2020-02-03 · CVE-2020-8498

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GistPress plugin versions prior to 3.0.2

Description The issue exists in the shortcode functionality of the plugin via the id parameter in the includes/class-gistpress.php file. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users, such as those who have the publish posts capability.

Recommendations For versions prior to 3.0.2, update to version 3.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the shortcode functionality to minimize the risk of exploitation. Avoid using the id parameter in the affected shortcode until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-8498

Affected Products

Gistpress

References · 6

• https://github.com/bradyvercher/gistpress/commit/e3f260edb6673227b0471c74b7ab13c094411ef7 · Patch
• https://osv.dev/vulnerability/CVE-2020-8498 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8498 · Security Note
• https://wpvulndb.com/vulnerabilities/10053 · Patch
• https://github.com/bradyvercher/gistpress/releases/tag/v3.0.2 · Note
• https://t.me/cvenotify/692 · Telegram Post