Stored Cross-Site Scripting Vulnerability in Async JavaScript Plugin for WordPress

CVE-2020-36854

What is CVE-2020-36854?

The Async JavaScript plugin for WordPress is susceptible to stored cross-site scripting due to inadequate authorization checks on the aj_steps AJAX action and improper sanitization of settings. This vulnerability allows authenticated attackers with subscriber-level permissions and higher to embed malicious scripts, which are executed whenever a user accesses the affected page, posing significant security risks to the site.

References