CVE-2020-36711: Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting
The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the updatelayout function in versions up to, and including, 6.2.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers, and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-36711?
The severity of CVE-2020-36711 is rated as medium due to the potential for stored cross-site scripting vulnerabilities that can affect website integrity.
How do I fix CVE-2020-36711?
To fix CVE-2020-36711, update the Avada theme to version 6.2.4 or higher, which addresses the input sanitization issues.
Who is affected by CVE-2020-36711?
CVE-2020-36711 affects installations of the Avada theme for WordPress versions up to and including 6.2.3.
What are the potential impacts of CVE-2020-36711?
The potential impacts of CVE-2020-36711 include unauthorized injection of scripts, potentially compromising user data or website functionality.
What is the nature of the vulnerability described in CVE-2020-36711?
CVE-2020-36711 is a Stored Cross-Site Scripting vulnerability caused by insufficient input sanitization in the update_layout function.