CVE-2020-13643 Cross-site request forgery in n/a
Missing nonce verification in the SiteOrigin Page Builder live editor allows attackers to forge requests and execute malicious JavaScript in an administrator's browser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-13643?
CVE-2020-13643 is a high-severity vulnerability in n/a, published on 28 May 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The live_editor_panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser.
Weakness: CWE-352
Which versions are affected by CVE-2020-13643?
It affects 1 product.
Products include Siteorigin Page Builder.
How do I fix CVE-2020-13643?
No fix has been published for CVE-2020-13643 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-13643 being exploited?
There is no known exploitation of CVE-2020-13643 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-13642 Cross-site request forgery in n/a
- CVE-2025-1459 Page Builder by SiteOrigin <= 2.31.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12240 Page Builder by SiteOrigin <= 2.31.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Row Label Parameter
- CVE-2024-4361 Cross-site scripting in Page Builder by SiteOrigin
- CVE-2024-2202 Page Builder by SiteOrigin <= 2.29.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Legacy Image Widget
Sources
Also known as GHSA-2gwc-rv3v-q9qp.