CVE-2020-13642 Cross-site request forgery in n/a
Missing nonce verification in SiteOrigin Page Builder allows attackers to forge admin requests and execute malicious JavaScript via panels_data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-13642?
CVE-2020-13642 is a high-severity vulnerability in n/a, published on 28 May 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser.
Weakness: CWE-352
Which versions are affected by CVE-2020-13642?
It affects 1 product.
Products include Siteorigin Page Builder.
How do I fix CVE-2020-13642?
No fix has been published for CVE-2020-13642 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-13642 being exploited?
There is no known exploitation of CVE-2020-13642 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-13643 Cross-site request forgery in n/a
- CVE-2025-1459 Page Builder by SiteOrigin <= 2.31.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12240 Page Builder by SiteOrigin <= 2.31.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Row Label Parameter
- CVE-2024-4361 Cross-site scripting in Page Builder by SiteOrigin
- CVE-2024-2202 Page Builder by SiteOrigin <= 2.29.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Legacy Image Widget
Sources
Also known as GHSA-w9cf-4g5p-cgf3.