CVE-2020-15537

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field, a product field to the p/ URI, or the Products Search box.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cxsecurity.com/issue/WLB-2020040032Exploit, Third Party Advisory
https://packetstormsecurity.com/files/157099/Vanguard-2.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://cxsecurity.com/issue/WLB-2020040032Exploit, Third Party Advisory
https://packetstormsecurity.com/files/157099/Vanguard-2.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry

Timeline

Published: Jul 5, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-155386.1XSS can occur in We-com Municipality portal CMS 2.1.x via the cerca/ search bar.CVE-2020-155399.8SQL injection can occur in We-com Municipality portal CMS 2.1.x via the cerca/ keywords field.CVE-2020-15547.8A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully ex CVE-2020-155409.8We-com OpenData CMS 2.0 allows SQL Injection via the username field on the administrator login page.CVE-2020-155419.8SolarWinds Serv-U FTP server before 15.2.1 allows remote command execution.CVE-2020-155429.8SolarWinds Serv-U FTP server before 15.2.1 mishandles the CHMOD command.CVE-2020-155439.8SolarWinds Serv-U FTP server before 15.2.1 does not validate an argument path.CVE-2020-15558.8A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based). CVE-2020-15567.8An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory. An attacker who successf CVE-2020-155626.1An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-CVE-2020-155636.5An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 H CVE-2020-155646.5An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to cause a hypervisor crash because of a missing alignment check