CVE-2020-35947 - CVE House
Back to Database
Status published High CVE-2020-35947

An issue was discovered in the PageLayer plugin before 1.1.2...

Vulnerability Description

An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. Nearly all of the AJAX action endpoints lacked permission checks, allowing these actions to be executed by anyone authenticated on the site. This happened because nonces were used as a means of authorization, but a nonce was present in a publicly viewable page. The greatest impact was the pagelayer_save_content function that allowed pages to be modified and allowed XSS to occur.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-35947

Credits & Attribution

No credits recorded in the NVD database.

References

More from pagelayer

View All →
CVE-2020-36384
PageLayer before 1.3.5 allows reflected XSS via color settings....
Medium 6.1
CVE-2020-36383
PageLayer before 1.3.5 allows reflected XSS via the font-size parameter....
Medium 6.1
CVE-2020-35944
An issue was discovered in the PageLayer plugin before 1.1.2...
High 8.8

Affected Vendor

Affected Software

pagelayer
Vulnerable Versions:
0

Timeline

Official Publish: January 1st, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AC:L/AV:N/A:L/C:L/I:L/PR:L/S:C/UI:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.