Medium severity6.1NVD Advisory· Published Apr 7, 2020· Updated Jun 17, 2026
CVE-2020-11509
CVE-2020-11509
Description
An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arbitrary JavaScript via the c37_wpl_import_template admin-post action (which will execute in an administrator's browser if the template is used to create a page).
Affected products
2- WordPress/WP Lead Plus X plugindescription
- Range: <=0.98
Patches
Vulnerability mechanics
References
1- www.wordfence.com/blog/2020/04/critical-vulnerabilities-in-the-wp-lead-plus-x-wordpress-plugin/nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.