← All advisories

Medium severity5.4NVD Advisory· Published Jun 5, 2020· Updated Jun 17, 2026

CVE-2020-13870

CVE-2020-13870

Description

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
verbb/commentsPackagist	< 1.5.5	1.5.5

Affected products

3

Craft CMS/Comments plugindescription
Verbb/Comments
cpe:2.3:a:verbb:comments:*:*:*:*:*:craft_cms:*:*
Range: <1.5.5
ghsa-coords
pkg:composer/verbb/comments
Range: < 1.5.5

Patches

Vulnerability mechanics

References

3

github.com/advisories/GHSA-69ww-wv3j-mhg4ghsaADVISORY
github.com/verbb/comments/blob/craft-3/CHANGELOG.mdnvdRelease NotesThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2020-13870ghsaADVISORY

News mentions

0

No linked articles in our index yet.