CVE-2020-11029

Published: Apr 30, 2020Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

Affected (21)

Products: Debian: Debian Linux · Wordpress: Wordpress

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration B

18 vulnerable

Vulnerable Software	Affected Versions
Wordpress Wordpress	From 3.7 to 3.7.33
Wordpress Wordpress	From 3.8 to 3.8.33
Wordpress Wordpress	From 3.9 to 3.9.31
Wordpress Wordpress	From 4.0 to 4.0.30
Wordpress Wordpress	From 4.1 to 4.1.30
Wordpress Wordpress	From 4.2 to 4.2.27
Wordpress Wordpress	From 4.3 to 4.3.23
Wordpress Wordpress	From 4.4 to 4.4.22
Wordpress Wordpress	From 4.5 to 4.5.21
Wordpress Wordpress	From 4.6 to 4.6.18
Wordpress Wordpress	From 4.7 to 4.7.17
Wordpress Wordpress	From 4.8 to 4.8.13
Wordpress Wordpress	From 4.9 to 4.9.14
Wordpress Wordpress	From 5.0 to 5.0.9
Wordpress Wordpress	From 5.1 to 5.1.5
Wordpress Wordpress	From 5.2 to 5.2.6
Wordpress Wordpress	From 5.3 to 5.3.3
Wordpress Wordpress	Version 5.4