Stored Cross-Site Scripting in KingComposer Plugin for WordPress
CVE-2020-36709

5.5MEDIUM

Key Information:

Vendor
Wordpress
Status
Page Builder: Kingcomposer – Free Drag And Drop Page Builder By King-theme
Vendor
CVE Published:
7 June 2023

Summary

The KingComposer plugin for WordPress is affected by a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in shortcodes. This allows authenticated attackers to craft malicious scripts that can be injected into web pages. When users access these compromised pages, the injected scripts are executed, potentially leading to unauthorized actions or data exposure.

Affected Version(s)

Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme * < 2.9.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://blog.nintechnet.com/wordpress-kingcomposer-page-b...
https://wpsocket.com/plugin/kingcomposer/changelog/

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jerome Bruandet
.