WordPress Page Builder by SiteOrigin plugin <= 2.10.15 - Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS)

2020-05-1100:00:00

WordFence

patchstack.com

EPSS

0.001

Percentile

44.3%

JSON

Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS) discovered by WordFence in WordPress Page Builder by SiteOrigin plugin (versions <= 2.10.15).

Solution

           Update the WordPress Page Builder by SiteOrigin plugin to the latest available version (at least 2.10.16).

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13643

wordpress.org/plugins/siteorigin-panels/#developers

www.wordfence.com/blog/2020/05/vulnerabilities-patched-in-page-builder-by-siteorigin-affects-over-1-million-sites/

EPSS

0.001

Percentile

44.3%

JSON

Related for PATCHSTACK:1F4A8AEE1A2BE1F541DAFA7A3C61E629