CVE-2020-13643

An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The live_editor_panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser.

• CWE-352

• https://wordpress.org/plugins/siteorigin-panels/#developersRelease Notes, Third Party Advisory
• https://www.wordfence.com/blog/2020/05/vulnerabilities-patched-in-page-builder-by-siteorigin-affects-over-1-million-sites/Exploit, Third Party Advisory
• https://wordpress.org/plugins/siteorigin-panels/#developersRelease Notes, Third Party Advisory
• https://www.wordfence.com/blog/2020/05/vulnerabilities-patched-in-page-builder-by-siteorigin-affects-over-1-million-sites/Exploit, Third Party Advisory

Published

May 28, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13638lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has a…9.8
• CVE-2020-13639A stored XSS vulnerability was discovered in the ECT Provide…6.1
• CVE-2020-1364A denial of service vulnerability exists in the way that the…7.1
• CVE-2020-13640A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 …9.8
• CVE-2020-13641An issue was discovered in the Real-Time Find and Replace pl…8.8
• CVE-2020-13642An issue was discovered in the SiteOrigin Page Builder plugi…8.8
• CVE-2020-13644An issue was discovered in the Accordion plugin before 2.2.9…5.4
• CVE-2020-13645In GNOME glib-networking through 2.64.2, the implementation …6.5
• CVE-2020-13646In Cheetah free WiFi 5.1, the driver file (liebaonat.sys) al…7.8
• CVE-2020-13649parser/js/js-scanner.c in JerryScript 2.2.0 mishandles error…7.5
• CVE-2020-1365An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-13650An issue was discovered in DigDash 2018R2 before p20200210 a…7.5