UpHeron
All vulnerabilities

WordPress core

CVE-2020-11029

WordPress: Cross-site scripting in stats method (object cache)

Severity
Medium 6.1
Published
30 Apr 2020
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
4.9.14, 5.0.9, 5.1.5, 5.2.6, 5.3.3, 5.4.1
Also known as
GHSA-568w-8m88-8g2c
Sources
NVD, WordPress

Description

In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33,…

Affected software

SoftwareAffected versions
WordPressWordPress core · cpe:a:wordpress:wordpress
  • Version 5.4
  • From 5.3 before 5.3.3
  • From 5.2 before 5.2.6
  • From 5.1 before 5.1.5
All 19 release lines
  • From 3.7 before 5.4.1
  • From 3.7 before 3.7.33
  • From 3.8 before 3.8.33
  • From 3.9 before 3.9.31
  • From 4.0 before 4.0.30
  • From 4.1 before 4.1.30
  • From 4.2 before 4.2.27
  • From 4.3 before 4.3.23
  • From 4.4 before 4.4.22
  • From 4.5 before 4.5.21
  • From 4.6 before 4.6.18
  • From 4.7 before 4.7.17
  • From 4.8 before 4.8.13
  • From 4.9 before 4.9.14
  • From 5.0 before 5.0.9
  • From 5.1 before 5.1.5
  • From 5.2 before 5.2.6
  • From 5.3 before 5.3.3
  • Version 5.4

References