CVE-2020-8498

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users (e.g., ones who have the publish_posts capability).

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/bradyvercher/gistpress/commit/e3f260edb6673227b0471c74b7ab13c094411ef7Patch
https://github.com/bradyvercher/gistpress/releases/tag/v3.0.2Release Notes
https://wpvulndb.com/vulnerabilities/10053Patch, Third Party Advisory
https://github.com/bradyvercher/gistpress/commit/e3f260edb6673227b0471c74b7ab13c094411ef7Patch
https://github.com/bradyvercher/gistpress/releases/tag/v3.0.2Release Notes
https://wpvulndb.com/vulnerabilities/10053Patch, Third Party Advisory

Timeline

Published: Jan 30, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-85007.2In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component. NOTE CVE-2020-85036.5Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 and 6.0.1000 through 6.0.1003 allows Insecure Direct Object Reference (IDOR) by CVE-2020-85046.5School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user.CVE-2020-85056.5School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user.CVE-2020-85065.3The Global TV application 2.3.2 for Android and 4.7.5 for iOS sends Unencrypted Analytics.CVE-2020-85077.5The Citytv Video application 4.08.0 for Android and 3.35 for iOS sends Unencrypted Analytics.CVE-2020-85089.8nsak64.sys in Norman Malware Cleaner 2.08.08 allows users to call arbitrary kernel functions because the passing of function pointers betwee CVE-2020-85097.5Zoho ManageEngine Desktop Central before 10.0.483 allows unauthenticated users to access PDFGenerationServlet, leading to sensitive informat CVE-2020-85109.8An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en (user+pe CVE-2020-85117.2In Artica Pandora FMS through 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the File Repository component, a CVE-2020-85126.1In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.CVE-2020-85146.1An issue was discovered in Rumpus 8.2.10 on macOS. By crafting a directory name, it is possible to activate JavaScript in the context of the