CVE-2020-36656 Spectra < 1.15.0 - Contributor+ Stored Cross-Side Scripting

What is CVE-2020-36656?

CVE-2020-36656 is a medium-severity cross-site scripting vulnerability in Unknown Spectra, published on 21 Feb 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

The Spectra WordPress plugin before 1.15.0 does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks.

Weakness: CWE-79

Which versions are affected by CVE-2020-36656?

It affects 1 product.

Products include Brainstormforce Spectra.

How do I fix CVE-2020-36656?

No fix has been published for CVE-2020-36656 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2020-36656 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36656 exists.

Other vulnerabilities in Unknown Spectra

• CVE-2023-36679 WordPress Spectra plugin <= 2.6.6 - Server Side Request Forgery (SSRF) vulnerability High 7.1
• CVE-2024-7590 WordPress Spectra plugin<= 2.14.1 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2023-49833 WordPress Spectra Plugin <= 2.7.9 is vulnerable to Cross Site Scripting (XSS) Medium 6.5
• CVE-2024-10484 Cross-site scripting in Spectra Gutenberg Blocks – Website Builder for the Block Editor Medium 6.4
• CVE-2024-4366 Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3xxh-w577-324m.