CVE-2020-36769

The Widget Settings Importer/Exporter Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp_ajax_import_widget_dataparameter AJAX action in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with subscriber-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79
• CWE-79

• https://www.wordfence.com/blog/2020/04/unpatched-high-severity-vulnerability-in-widget-settings-importer-exporter-plugin/Exploit, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e14f0fc6-fca4-4dd7-8f7b-ed5ed535c9af?source=cveThird Party Advisory
• https://www.wordfence.com/blog/2020/04/unpatched-high-severity-vulnerability-in-widget-settings-importer-exporter-plugin/Exploit, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e14f0fc6-fca4-4dd7-8f7b-ed5ed535c9af?source=cveThird Party Advisory

Published

Dec 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36762A vulnerability was found in ONS Digital RAS Collection Inst…9.8
• CVE-2020-36763Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allow…5.4
• CVE-2020-36765Insufficient policy enforcement in Navigation in Google Chro…6.5
• CVE-2020-36766An issue was discovered in the Linux kernel before 5.8.6. dr…3.3
• CVE-2020-36767tinyfiledialogs (aka tiny file dialogs) before 3.8.0 allows …7.5
• CVE-2020-36768A vulnerability was found in rl-institut NESP2 Initial Relea…9.8
• CVE-2020-36770pkg_postinst in the Gentoo ebuild for Slurm through 22.05.3 …9.8
• CVE-2020-36771CloudLinux CageFS 7.1.1-1 or below passes the authentication…7.8
• CVE-2020-36772CloudLinux CageFS 7.0.8-2 or below insufficiently restricts …4.4
• CVE-2020-36773Artifex Ghostscript before 9.53.0 has an out-of-bounds write…9.8
• CVE-2020-36774plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 an…5.5
• CVE-2020-36775In the Linux kernel, the following vulnerability has been re…5.5