CVE-2020-11029

Published: Apr 30, 2020Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

Affected (21)

Products: Debian: Debian Linux · Wordpress: Wordpress

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration B

18 vulnerable

Vulnerable Software	Affected Versions
Wordpress Wordpress	3.7 ≤ version < 3.7.33
Wordpress Wordpress	3.8 ≤ version < 3.8.33
Wordpress Wordpress	3.9 ≤ version < 3.9.31
Wordpress Wordpress	4.0 ≤ version < 4.0.30
Wordpress Wordpress	4.1 ≤ version < 4.1.30
Wordpress Wordpress	4.2 ≤ version < 4.2.27
Wordpress Wordpress	4.3 ≤ version < 4.3.23
Wordpress Wordpress	4.4 ≤ version < 4.4.22
Wordpress Wordpress	4.5 ≤ version < 4.5.21
Wordpress Wordpress	4.6 ≤ version < 4.6.18
Wordpress Wordpress	4.7 ≤ version < 4.7.17
Wordpress Wordpress	4.8 ≤ version < 4.8.13
Wordpress Wordpress	4.9 ≤ version < 4.9.14
Wordpress Wordpress	5.0 ≤ version < 5.0.9
Wordpress Wordpress	5.1 ≤ version < 5.1.5
Wordpress Wordpress	5.2 ≤ version < 5.2.6
Wordpress Wordpress	5.3 ≤ version < 5.3.3
Wordpress Wordpress	Version 5.4