CVE-2020-13870

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name...

CVE-2020-13870

CVE-2020-13870 affects the Craft CMS Comments plugin prior to 1.5.5, with a stored XSS flaw via an asset volume name. Root cause: lack of input validation leading to stored XSS. Impact is dependent on affected Craft CMS deployments; remediation is to upgrade the Comments plugin to 1.5.5 or later....