CVE-2020-11025

In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

• CWE-79
• CWE-79

• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4mhg-j6fx-5g3cThird Party Advisory
• https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updatesVendor Advisory
• https://www.debian.org/security/2020/dsa-4677Third Party Advisory
• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4mhg-j6fx-5g3cThird Party Advisory
• https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updatesVendor Advisory
• https://www.debian.org/security/2020/dsa-4677Third Party Advisory

Published

Apr 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1102A remote code execution vulnerability exists in Microsoft Sh…8.8
• CVE-2020-11020Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1…9.8
• CVE-2020-11021Actions Http-Client (NPM @actions/http-client) before versio…7.5
• CVE-2020-11022In jQuery starting with 1.12.0 and before 3.5.0, passing HTM…6.1
• CVE-2020-11023In jQuery versions greater than or equal to 1.0.3 and before…6.1
• CVE-2020-11024In Moonlight iOS/tvOS before 4.0.1, the pairing process is v…8.2
• CVE-2020-11026In affected versions of WordPress, files with a specially cr…5.4
• CVE-2020-11027In affected versions of WordPress, a password reset link ema…8.1
• CVE-2020-11028In affected versions of WordPress, some private posts, which…7.5
• CVE-2020-11029In affected versions of WordPress, a vulnerability in the st…6.1
• CVE-2020-1103An information disclosure vulnerability exists where certain…6.5
• CVE-2020-11030In affected versions of WordPress, a special payload can be …5.4