CVE-2020-8498

XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users (e.g., ones who have the publish_posts capability).

• CWE-79

• https://github.com/bradyvercher/gistpress/commit/e3f260edb6673227b0471c74b7ab13c094411ef7Patch
• https://github.com/bradyvercher/gistpress/releases/tag/v3.0.2Release Notes
• https://wpvulndb.com/vulnerabilities/10053Patch, Third Party Advisory
• https://github.com/bradyvercher/gistpress/commit/e3f260edb6673227b0471c74b7ab13c094411ef7Patch
• https://github.com/bradyvercher/gistpress/releases/tag/v3.0.2Release Notes
• https://wpvulndb.com/vulnerabilities/10053Patch, Third Party Advisory

Published

Jan 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8492Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.…6.5
• CVE-2020-8493A stored XSS vulnerability in Kronos Web Time and Attendance…4.8
• CVE-2020-8494In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.…8.8
• CVE-2020-8495In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.…7.5
• CVE-2020-8496In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.…4.8
• CVE-2020-8497In Artica Pandora FMS through 7.42, an unauthenticated attac…5.3
• CVE-2020-8500In Artica Pandora FMS 7.42, Web Admin users can execute arbi…7.2
• CVE-2020-8503Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 …6.5
• CVE-2020-8504School Management Software PHP/mySQL through 2019-03-14 allo…6.5
• CVE-2020-8505School Management Software PHP/mySQL through 2019-03-14 allo…6.5
• CVE-2020-8506The Global TV application 2.3.2 for Android and 4.7.5 for iO…5.3
• CVE-2020-8507The Citytv Video application 4.08.0 for Android and 3.35 for…7.5