CVE-2020-11025: Authenticated cross-site scripting (XSS) in WordPress Customizer
First published: Thu Apr 30 2020(Updated: )
In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/wordpress | 5.0.15+dfsg1-0+deb10u1 5.0.19+dfsg1-0+deb10u1 5.7.8+dfsg1-0+deb11u2 6.1.1+dfsg1-1 6.3.1+dfsg1-1 | |
| WordPress WordPress | >=4.7<5.4.1 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2020-11030
- https://security-tracker.debian.org/tracker/CVE-2020-11025
- https://security-tracker.debian.org/tracker/CVE-2020-11026
- https://security-tracker.debian.org/tracker/CVE-2020-11027
- https://security-tracker.debian.org/tracker/CVE-2020-11028
- https://security-tracker.debian.org/tracker/CVE-2020-11029
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11025
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11026
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11027
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11028
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11029
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11030
- https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates
- https://github.com/WordPress/wordpress-develop/commit/e65e7a3bd96df6675a9a3caa54f5945885379f09
- https://core.trac.wordpress.org/changeset/47636
- https://github.com/WordPress/wordpress-develop/commit/42cbfc76f87add1853996730c587ea66aa8fdc28
- https://core.trac.wordpress.org/changeset/47633
- https://core.trac.wordpress.org/changeset/47634
- https://core.trac.wordpress.org/changeset/47635
- https://core.trac.wordpress.org/changeset/47637
- https://core.trac.wordpress.org/changeset/47638
- https://github.com/WordPress/wordpress-develop/commit/f9be892b76512c0bf3826c07839dd7c406f13e06
- https://github.com/WordPress/wordpress-develop/blob/c7f320da2b05b261fc94b63dccc2fc0787641cf9/src/wp-includes/general-template.php#L221
- https://salsa.debian.org/debian/wordpress/-/commit/cd5c36bf6a87b3a9245121fb08e3a661c1d1c48e
- https://bugs.debian.org/959391
- https://security-tracker.debian.org/tracker/CVE-2019-20043
- https://security-tracker.debian.org/tracker/CVE-2019-20041
- https://security-tracker.debian.org/tracker/CVE-2019-20042
- https://security-tracker.debian.org/tracker/CVE-2019-16780
- https://security-tracker.debian.org/tracker/CVE-2019-16781
- https://security-tracker.debian.org/tracker/CVE-2019-17674
- https://security-tracker.debian.org/tracker/CVE-2019-17671
- https://security-tracker.debian.org/tracker/CVE-2019-17672
- https://security-tracker.debian.org/tracker/CVE-2019-17673
- https://security-tracker.debian.org/tracker/CVE-2019-17669
- https://security-tracker.debian.org/tracker/CVE-2019-17675
- https://security-tracker.debian.org/tracker/CVE-2019-16223
- https://security-tracker.debian.org/tracker/CVE-2019-16218
- https://security-tracker.debian.org/tracker/CVE-2019-16220
- https://security-tracker.debian.org/tracker/CVE-2019-16217
- https://security-tracker.debian.org/tracker/CVE-2019-16219
- https://security-tracker.debian.org/tracker/CVE-2019-16221
- https://security-tracker.debian.org/tracker/CVE-2019-16222
- https://security-tracker.debian.org/tracker/CVE-2019-9787
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=959391
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4mhg-j6fx-5g3c
- https://github.com/WordPress/wordpress-develop/commit/cfb690cb8efaee32d55b10a7771afb0f1f47aab3
- https://www.debian.org/security/2020/dsa-4677
Frequently Asked Questions
What is CVE-2020-11025?
CVE-2020-11025 is a cross-site scripting (XSS) vulnerability in the navigation section of WordPress Customizer that allows execution of JavaScript code by an authenticated user.
How severe is CVE-2020-11025?
CVE-2020-11025 has a severity score of 5.4, which is considered medium.
How does CVE-2020-11025 affect WordPress?
CVE-2020-11025 affects certain versions of WordPress (5.0.15+dfsg1-0+deb10u1, 5.0.19+dfsg1-0+deb10u1, 5.7.8+dfsg1-0+deb11u2, 6.1.1+dfsg1-1, 6.3.1+dfsg1-1) by allowing a cross-site scripting (XSS) attack in the navigation section of the Customizer.
Is there a fix for CVE-2020-11025?
Yes, CVE-2020-11025 has been patched in WordPress version 5.4.1, as well as all previously affected versions.
Where can I find more information about CVE-2020-11025?
You can find more information about CVE-2020-11025 on the Debian Security Tracker: [CVE-2020-11025](https://security-tracker.debian.org/tracker/CVE-2020-11025).
- collector/debian-bugs
- alias/CVE-2020-11025
- collector/security-tracker-debian
- agent/type
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/references
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/title
- agent/tags
- agent/event
- agent/first-publish-date
- package-manager/debian
- vendor/wordpress
- canonical/wordpress wordpress
- version/wordpress wordpress/4.7
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0