{"id":"CVE-2020-36854","aliases":["EUVD-2020-30802","GHSA-c384-m2mr-c4gg"],"status":"published","title":"Async JavaScript \u003c= 2.19.07.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting","description":"The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,  2.19.07.14. This is due to missing authorization checks on the aj_steps AJAX aciton along with a lack on sanitization on the settings saved via the function. This makes it possible for authenticated attackers with subscriber level permissions and above to inject malicious web scripts into a page that execute whenever a user accesses that page.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00267,"percentile":0.19046,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-10-18T03:33:24Z","modified":"2026-06-17T03:16:20Z","products":[{"vendor":"cloughit","product":"async javascript"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b133888c-7673-4796-917c-486bff1b6b12?source=cve"},{"url":"https://www.wordfence.com/blog/2020/02/site-takeover-campaign-exploits-multiple-zero-day-vulnerabilities/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36854"},{"url":"https://www.wordfence.com/blog/2020/02/site-takeover-campaign-exploits-multiple-zero-day-vulnerabilities"},{"url":"https://github.com/advisories/GHSA-c384-m2mr-c4gg"}],"sources":{"cve":[{"id":"CVE-2020-36854","title":"Async JavaScript \u003c= 2.19.07.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting","description":"The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,  2.19.07.14. This is due to missing authorization checks on the aj_steps AJAX aciton along with a lack on sanitization on the settings saved via the function. This makes it possible for authenticated attackers with subscriber level permissions and above to inject malicious web scripts into a page that execute whenever a user accesses that page.","status":"published","published":"2025-10-18T03:33:24.573Z","modified":"2026-04-08T17:16:10.864Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:55.128961Z"}],"euvd":[{"id":"EUVD-2020-30802","description":"The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,  2.19.07.14. This is due to missing authorization checks on the aj_steps AJAX aciton along with a lack on sanitization on the settings saved via the function. This makes it possible for authenticated attackers with subscriber level permissions and above to inject malicious web scripts into a page that execute whenever a user accesses that page.","status":"published","published":"2025-10-18T03:33:24Z","modified":"2026-04-08T17:16:10Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:44.656375Z"}],"ghsa":[{"id":"GHSA-c384-m2mr-c4gg","title":"The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in...","description":"The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,  2.19.07.14. This is due to missing authorization checks on the aj_steps AJAX aciton along with a lack on sanitization on the settings saved via the function. This makes it possible for authenticated attackers with subscriber level permissions and above to inject malicious web scripts into a page that execute whenever a user accesses that page.","status":"published","published":"2025-10-18T06:30:25Z","modified":"2025-10-18T06:30:31Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:04:01.823376Z"}],"nvd":[{"id":"CVE-2020-36854","description":"The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,  2.19.07.14. This is due to missing authorization checks on the aj_steps AJAX aciton along with a lack on sanitization on the settings saved via the function. This makes it possible for authenticated attackers with subscriber level permissions and above to inject malicious web scripts into a page that execute whenever a user accesses that page.","status":"published","published":"2025-10-18T04:16:04.037Z","modified":"2026-06-17T03:16:20.267Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:48.591569Z"}]}}