Medium severity · published Aug 31, 2020
CVE-2020-15020
An issue was discovered in the Elementor plugin through 2.9.13 for WordPress
5.4
CVSS
0.7%
EPSS
No
On KEV
Description
An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WB
Website Builder · Elementor
through 2.9.13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15020
Third Party Advisory
http://hidden-one.co.in/2020/07/07/cve-2020-1020-stored-xss-on-elementor-wordpress-plugin/
Product
https://wordpress.org/plugins/elementor/#developers
More from Website Builder
9.8
CVE-2023-47504
WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability
9.8
CVE-2020-7109
The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template
8.8
CVE-2023-48777
WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability
8.8
CVE-2022-1329
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the…
8.1
CVE-2024-24934
WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability