Textpattern
CVE-2020-35854
MEDIUM
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
Textpattern 4.8.4 is affected by cross-site scripting (XSS) in the Body parameter.
AnalysisAI
Textpattern 4.8.4 is affected by cross-site scripting (XSS) in the Body parameter. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Textpattern 4.8.4 is affected by cross-site scripting (XSS) in the Body parameter. Affected products include: Textpattern.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
More in Textpattern
View allAn issue was discovered in Textpattern CMS 4.6.2 and earlier. Rated critical severity (CVSS 9.8), this vulnerability is
There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of
An arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows attackers to execute a
Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem. Rated high severity (CVSS 8.8), this vulnerability is remotel
textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial
Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary
An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute
Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background witho
A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which a
A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remo
Cross-site scripting (XSS) vulnerability in Textpattern CMS before 4.5.7 allows remote attackers to inject arbitrary web
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today