Stored Cross-Site Scripting Vulnerability in Async JavaScript Plugin for WordPress

CVE-2020-36854

What is CVE-2020-36854?

The Async JavaScript plugin for WordPress is susceptible to stored cross-site scripting due to inadequate authorization checks on the aj_steps AJAX action and improper sanitization of settings. This vulnerability allows authenticated attackers with subscriber-level permissions and higher to embed malicious scripts, which are executed whenever a user accesses the affected page, posing significant security risks to the site.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References