CVE-2020-28650: XSS
Published Nov 16, 2020
·Updated
The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls ksesremovefilters to disable the standard WordPress XSS protection mechanism for the Author and Contributor roles.
Affected Software
1 affected component
wpbakery Page Builder Wordpress<6.4.1
Event History
Nov 16, 2020
CVE Published
via MITRE·02:49 AM
Data Sourced
via MITRE·02:49 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2020-28650?
CVE-2020-28650 is considered a high severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
2
How do I fix CVE-2020-28650?
To fix CVE-2020-28650, update the WPBakery plugin to version 6.4.1 or later.
3
Which versions of WPBakery are affected by CVE-2020-28650?
CVE-2020-28650 affects WPBakery plugin versions prior to 6.4.1.
4
What types of attacks are possible due to CVE-2020-28650?
CVE-2020-28650 allows attackers to execute arbitrary JavaScript in the context of users with Author and Contributor roles, leading to XSS.
5
Is there a workaround for CVE-2020-28650 if I can't update immediately?
Currently, the best workaround for CVE-2020-28650 is to limit user roles and permissions until the plugin can be updated.