CVE-2020-20406

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions. It is caused by inadequate filtering on the link custom attributes.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://wordpress.org/plugins/elementor/#developersProduct, Third Party Advisory
https://wordpress.org/plugins/elementor/#developersProduct, Third Party Advisory

Timeline

Published: Sep 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-20417.5An insecure configuration of the appweb daemon of Palo Alto Networks PAN-OS 8.1 allows a remote unauthenticated user to send a specifically CVE-2020-204126.5lib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has insufficient array bounds checking via a craft CVE-2020-204139.8SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle() function in ad CVE-2020-20427.2A buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and p CVE-2020-204256.1S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search function.CVE-2020-204266.1S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in /function/booksave.php.CVE-2020-20433.3An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo CVE-2020-20443.3An information exposure through log file vulnerability where an administrator's password or other sensitive information may be logged in cle CVE-2020-204447.2Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET paramet CVE-2020-204456.5FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicious user to cause a Denial of Service.CVE-2020-204466.5FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious user to cause a Denial of Service.CVE-2020-204486.5FFmpeg 4.1.3 is affected by a Divide By Zero issue via libavcodec/ratecontrol.c, which allows a remote malicious user to cause a Denial of S