CVE-2020-29455

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to inject arbitrary web script or HTML via any address parameter (e.g., street or country).

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/smartystreets-archivesThird Party Advisory
https://jsfiddle.net/smartystreets/Lx2dbsaa/Third Party Advisory
https://www.guidepointsecurity.com/liveaddressplugin-js-vulnerability-disclosure/Exploit, Third Party Advisory
https://github.com/smartystreets-archivesThird Party Advisory
https://jsfiddle.net/smartystreets/Lx2dbsaa/Third Party Advisory
https://www.guidepointsecurity.com/liveaddressplugin-js-vulnerability-disclosure/Exploit, Third Party Advisory

Timeline

Published: Dec 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-294566.1Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML CVE-2020-294574.4A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connecti CVE-2020-294588.8Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem.CVE-2020-29466.0Vulnerability in the Application Performance Management product of Oracle Enterprise Manager (component: EM Request Monitoring). Supported v CVE-2020-294695.4WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component. This vulnerability can allow an attacker to inject the XSS CVE-2020-29474.3Vulnerability in the PeopleSoft Enterprise HCM Absence Management product of Oracle PeopleSoft (component: Absence Management). The supporte CVE-2020-294704.8OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an attacker to inject CVE-2020-294714.8OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code usi CVE-2020-294729.8EGavilan Media Under Construction page with cPanel 1.0 contains a SQL injection vulnerability. An attacker can gain Admin Panel access using CVE-2020-294749.8EGavilan Media EGM Address Book 1.0 contains a SQL injection vulnerability. An attacker can gain Admin Panel access using malicious SQL inje CVE-2020-294754.8nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. This vulnerability can allow an attacker CVE-2020-294774.8Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. This vulnerability can allow an attacker to inje