CVE-2020-26153 describes a cross-site scripting (XSS) vulnerability in the Event Espresso Core plugin for WordPress, specifically affecting versions prior to 4.10.7.p. This flaw allows remote attackers to inject malicious web scripts or HTML through the 'page' parameter. With a CVSS score of 6.1 (MEDIUM) and an EPSS score indicating higher exploitability than 97% of all CVEs, the vulnerability requires user interaction (UI:R) but can be exploited without authentication (PR:N), leading to potential information disclosure and integrity impacts (C:L/I:L). While no active exploitation is reported and no Metasploit or ExploitDB modules exist, Nuclei templates are available, and there is minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.10.7.pCPE matchmatch criteria | cpe:2.3:a:eventespresso:event_espresso:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.