Cross-Site Scripting in LeptonCMS by Lepton

CVE-2020-12707

Summary

An XSS vulnerability in LeptonCMS version 4.5.0, located in modules/wysiwyg/save.php, can be exploited by attackers. The primary security measure in place involves stripping SCRIPT elements; however, this is insufficient as malicious actors can leverage HTML event handlers to execute JavaScript. This creates a substantial risk for users and highlights the need for improved input validation and output encoding to mitigate such attacks.

References