{"id":"CVE-2020-11030","published":"2020-04-30T22:15:14Z","modified":"2024-08-04T11:21:14Z","title":"Cross-site scripting (XSS) in Search block in WordPress","vendor":"WordPress","product":"WordPress","tier":"core","eol":null,"affectedVersions":[{"vendor":"WordPress","product":"WordPress","versions":[">= 5.4.0, < 5.4.1",">= 5.3.0, < 5.3.3",">= 5.2.0, < 5.2.6",">= 5.1.0, < 5.1.5",">= 5.0.0, < 5.0.9",">= 4.9.0, < 4.9.14",">= 4.8.0, < 4.8.13",">= 4.7.0, < 4.7.17",">= 4.6.0, < 4.6.18",">= 4.5.0, < 4.5.21"]}],"description":{"text":"In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":6.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01437,"percentile":0.73044,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-707","name":"Improper Neutralization"}],"references":[{"url":"https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates","tags":["x_refsource_MISC"]},{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-vccm-6gmc-qhjh","tags":["x_refsource_CONFIRM"]},{"url":"https://www.debian.org/security/2020/dsa-4677","tags":["vendor-advisory","x_refsource_DEBIAN"]}],"techniques":[{"id":"T1204.001","name":"Malicious Link","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"exploitation_technique","evidence":[],"confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"primary_impact","evidence":[],"confidence":"high"},{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"secondary_impact","evidence":[],"confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-3415","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-3415","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1059.007"],"provenance":"source"},{"stage":"secondary","techniques":["T1557"],"provenance":"source"},{"stage":"related","techniques":["T1204.001"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2020-04-30","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-11030","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":19.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":14.61,"detail":"percentile 0.7304"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":4.48,"detail":"base score 6.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}