CVE-2020-13864

{"id": "CVE-2020-13864", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2020-06-05T22:15:12.070", "references": [{"url": "https://www.softwaresecured.com/elementor-page-builder-stored-xss/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.softwaresecured.com/elementor-page-builder-stored-xss/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links."}, {"lang": "es", "value": "El plugin Elementor Page Builder versiones anteriores a 2.9.9 para WordPress, sufre de una vulnerabilidad de tipo XSS almacenado. Un usuario autor puede crear publicaciones que resulten en un ataque de tipo XSS almacenado mediante el uso de una carga \u00fatil dise\u00f1ada en enlaces personalizados"}], "lastModified": "2024-11-21T05:02:01.993", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elementor:elementor_page_builder:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "9F510872-5BE1-440A-8054-24DFF9653B39", "versionEndExcluding": "2.9.9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}