Stored Cross-Site Scripting Vulnerability in Team Showcase Plugin for WordPress
CVE-2020-35937
7.5HIGH
What is CVE-2020-35937?
The Team Showcase plugin for WordPress is susceptible to stored Cross-Site Scripting (XSS) vulnerabilities. This flaw allows remote authenticated attackers to execute arbitrary JavaScript by importing layouts through AJAX using a specially crafted payload in the source parameter. Attackers can exploit this vulnerability by setting the action to team_import_xml_layouts, which poses a significant risk to users who unknowingly import compromised layouts.