CVE-2020-11727

A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woe_post_type parameter.

• CWE-79

• http://packetstormsecurity.com/files/157557/WordPress-WooCommerce-Advanced-Order-Export-3.1.3-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/browser/woo-order-export-lite/trunk/view/settings-form.phpThird Party Advisory
• https://wordpress.org/plugins/woo-order-export-lite/#developersRelease Notes, Third Party Advisory
• https://www.themissinglink.com.au/security-advisories-cve-2020-11727Third Party Advisory
• http://packetstormsecurity.com/files/157557/WordPress-WooCommerce-Advanced-Order-Export-3.1.3-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/browser/woo-order-export-lite/trunk/view/settings-form.phpThird Party Advisory
• https://wordpress.org/plugins/woo-order-export-lite/#developersRelease Notes, Third Party Advisory
• https://www.themissinglink.com.au/security-advisories-cve-2020-11727Third Party Advisory

Published

May 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11720An issue was discovered in Programi Bilanc build 007 release…9.8
• CVE-2020-11721load_png in loader.c in libsixel.a in libsixel 1.8.6 has an …6.5
• CVE-2020-11722Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 all…9.8
• CVE-2020-11723Cellebrite UFED 5.0 through 7.29 uses four hardcoded RSA pri…5.5
• CVE-2020-11724An issue was discovered in OpenResty before 1.15.8.4. ngx_ht…7.5
• CVE-2020-11725snd_ctl_elem_add in sound/core/control.c in the Linux kernel…7.8
• CVE-2020-11728An issue was discovered in DAViCal Andrew's Web Libraries (A…7.5
• CVE-2020-11729An issue was discovered in DAViCal Andrew's Web Libraries (A…9.8
• CVE-2020-1173A spoofing vulnerability exists in Microsoft Power BI Report…6.8
• CVE-2020-11731The Media Library Assistant plugin before 2.82 for Wordpress…6.1
• CVE-2020-11732The Media Library Assistant plugin before 2.82 for Wordpress…7.5
• CVE-2020-11733An issue was discovered on Spirent TestCenter and Avalanche …6.7