CVE-2020-28038

WordPress before 5.5.2 allows stored XSS via post slugs.

6.1 MediumFix available

CVE-2020-28038 is a medium vulnerability (CVSS 6.1) in Wordpress, published October 31, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.61%, the 85th percentile. Fixed in wordpress 5.5.2.

WordPress before 5.5.2 allows stored XSS via post slugs.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

2.61%Up 1.0 points since Apr 14, 2021

What each source reports

NVD Score used 6.1

WordPress before 5.5.2 allows stored XSS via post slugs.

Record: CVE-2020-28038
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

WordPress before 5.5.2 allows stored XSS via post slugs.

Record: CVE-2020-28038
Updated: 2026-11-02

EUVDEUVD-2020-20529 No score

WordPress before 5.5.2 allows stored XSS via post slugs.

Record: EUVD-2020-20529
Updated: 2026-11-03

GitHub AdvisoriesGHSA-mwxx-w555-5h5m 6.1

WordPress before 5.5.2 allows stored XSS via post slugs.

WordPress before 5.5.2 allows stored XSS via post slugs.

Record: GHSA-mwxx-w555-5h5m
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.1

WordPress before 5.5.2 allows stored XSS via post slugs.

Record: CVE-2020-28038
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2020-28038 6.1

WordPress before 5.5.2 allows stored XSS via post slugs.

Record: DEBIAN-CVE-2020-28038
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-28038 6.1

WordPress before 5.5.2 allows stored XSS via post slugs.

Record: UBUNTU-CVE-2020-28038
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVBIT-wordpress-2020-28038 No score

WordPress before 5.5.2 allows stored XSS via post slugs.

Record: BIT-wordpress-2020-28038
Updated: 2026-11-02

OSVBIT-wordpress-multisite-2020-28038 No score

WordPress before 5.5.2 allows stored XSS via post slugs.

Record: BIT-wordpress-multisite-2020-28038
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`wordpress` Bitnami	before 5.5.2	5.5.2
`wordpress-multisite` Bitnami	before 5.5.2	5.5.2
`wordpress` Debian:12	before 5.5.3+dfsg1-1	5.5.3+dfsg1-1
`wordpress` Debian:13	before 5.5.3+dfsg1-1	5.5.3+dfsg1-1
`wordpress` Debian:14	before 5.5.3+dfsg1-1	5.5.3+dfsg1-1
`wordpress` Debian:9	before 4.7.19+dfsg-1+deb9u1, plus listed versions 4.7.18+dfsg-1+deb9u14.7.5+dfsg-24.7.5+dfsg-2+deb9u14.7.5+dfsg-2+deb9u1~bpo8+14.7.5+dfsg-2+deb9u2 Show 5 moreShow less 4.7.5+dfsg-2+deb9u2~bpo8+14.7.5+dfsg-2+deb9u34.7.5+dfsg-2+deb9u44.7.5+dfsg-2+deb9u54.7.5+dfsg-2+deb9u6	4.7.19+dfsg-1+deb9u1
`wordpress` Debian:10	before 5.0.11+dfsg1-0+deb10u1, plus listed versions 5.0.10+dfsg1-0+deb10u15.0.4+dfsg1-15.0.4+dfsg1-1+deb10u15.0.4+dfsg1-1+deb10u2	5.0.11+dfsg1-0+deb10u1
`wordpress` Ubuntu:16.04:LTS	All versions, plus listed versions 4.3+dfsg-14.3.1+dfsg-14.4+dfsg-14.4.1+dfsg-14.4.2+dfsg-14.4.2+dfsg-1ubuntu1	None known
`wordpress` Ubuntu:18.04:LTS	All versions, plus listed versions 4.8.2+dfsg-24.8.3+dfsg-14.9.1+dfsg-14.9.2+dfsg-14.9.4+dfsg-14.9.5+dfsg1-1	None known
`wordpress` Ubuntu:20.04:LTS	All versions, plus listed versions 5.2.2+dfsg1-15.2.4+dfsg1-15.3.2+dfsg1-15.3.2+dfsg1-1ubuntu1	None known

Show 5 moreShow less

Affected packages
Package	Affected	Fixed
`wordpress` Ubuntu:22.04:LTS	All versions, plus listed versions 5.7.1+dfsg1-2ubuntu15.8.1+dfsg1-2ubuntu15.8.2+dfsg1-1ubuntu15.8.3+dfsg1-1ubuntu15.8.3+dfsg1-1ubuntu1.1	None known
`wordpress` Ubuntu:24.04:LTS	All versions, plus listed versions 6.2+dfsg1-1ubuntu16.4.3+dfsg1-1ubuntu1	None known
`wordpress` Ubuntu:25.10	All versions, plus listed versions 6.7.2+dfsg1-1.1ubuntu1	None known
`wordpress` Ubuntu:26.10	All versions, plus listed versions 6.7.2+dfsg1-1.1ubuntu2	None known
`wordpress` Ubuntu:26.04:LTS	All versions, plus listed versions 6.7.2+dfsg1-1.1ubuntu16.7.2+dfsg1-1.1ubuntu2	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 9 moreShow less