CVE-2020-25286

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://core.trac.wordpress.org/changeset/47984Patch, Vendor Advisory
https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/Vendor Advisory
https://core.trac.wordpress.org/changeset/47984Patch, Vendor Advisory
https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/Vendor Advisory

Timeline

Published: Sep 13, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-252877.2Pligg 2.0.3 allows remote authenticated users to execute arbitrary commands because the template editor can edit any file, as demonstrated b CVE-2020-252884.8An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression CVE-2020-252895.5The VPN service in AVAST SecureLine before 5.6.4982.470 allows local users to write to arbitrary files via an Object Manager symbolic link f CVE-2020-252917.8GdiDrawHoriLineIAlt in Kingsoft WPS Office before 11.2.0.9403 allows remote heap corruption via a crafted PLTE chunk in PNG data within a Wo CVE-2020-25306.1Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). Supported versions that are affected CVE-2020-25313.1Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: BI Platform Security). CVE-2020-25336.1Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). Supported versio CVE-2020-25346.1Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). Supported versio CVE-2020-253405.5An issue was discovered in NFStream 5.2.0. Because some allocated modules are not correctly freed, if the nfstream object is directly destro CVE-2020-253435.4Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML to fields['bo CVE-2020-25354.7Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Server). Supp CVE-2020-253516.5An information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote authenticated a