VULNERABILITY INTELLIGENCE

CVE-2020-24314

CVSS score6.1 MEDIUM

EPSS probability0.87%

CISA KEVNot currently listed

Published2020-08-26

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.

Weakness classification

nvd@nist.gov: CWE-79

Primary references

cve@mitre.org — Product, Third Party Advisory
cve@mitre.org — Exploit, Third Party Advisory, URL Repurposed
af854a3a-2127-422b-91ae-364da2661108 — Product, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, URL Repurposed