CVE-2020-36854

The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.19.07.14. This is due to missing authorization checks on the aj_steps AJAX aciton along with a lack on sanitization on the settings saved via the function. This makes it possible for authenticated attackers with subscriber level permissions and above to inject malicious web scripts into a page that execute whenever a user accesses that page.

• CWE-79

• https://www.wordfence.com/blog/2020/02/site-takeover-campaign-exploits-multiple-zero-day-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b133888c-7673-4796-917c-486bff1b6b12?source=cve

Published

Oct 18, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36849The AIT CSV import/export plugin for WordPress is vulnerable…9.8
• CVE-2020-3685Pointer variable which is freed is not cleared can result in…7.5
• CVE-2020-36850An information disclosure vulnerability exits in Sitecore JS…8.7
• CVE-2020-36851Rob--W cors-anywhere instances configured as an open proxy a…9.5
• CVE-2020-36852The Custom Searchable Data Entry System plugin for WordPress…9.1
• CVE-2020-36853The 10WebMapBuilder plugin for WordPress is vulnerable to St…7.2
• CVE-2020-36855A security vulnerability has been detected in DCMTK up to 3.…5.5
• CVE-2020-36856Nagios XI versions prior to 5.6.14 contain an authenticated …8.8
• CVE-2020-36857Nagios XI versions prior to 5.6.14 contain a post-authentica…7.2
• CVE-2020-36858Nagios Log Server versions prior to 2.1.6 contain cross-site…5.4
• CVE-2020-36859The Core Config Manager (CCM) in Nagios XI versions prior to…8.8
• CVE-2020-3686Possible memory out of bound issue during music playback whe…9.8