WordPress Plugin Vulnerabilities

Directories Pro < 1.3.46 - Authenticated Self-Reflected Cross-Site Scripting

Description

The plugin did not sanitise the column names when importing a malicious CSV file, allowing for HTML or JavaScript injection.

Proof of Concept

Affects Plugins

Plugin icon
directories
Fixed in 1.3.46

References

CVE
CVE-2020-29304
URL
https://seclists.org/fulldisclosure/2020/Dec/15

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Jack Misiura
Verified
No
WPVDB ID
fcf6894f-d2dd-4cd5-9d42-7f617c2bba32

Timeline

Publicly Published
2020-12-12 (about 5 years ago)
Added
2020-12-12 (about 5 years ago)
Last Updated
2020-12-14 (about 5 years ago)

Other

Published
Title
Published
2025-07-14
Title
Fade Slider <= 2.6 - Reflected Cross-Site Scripting
Published
2023-04-10
Title
WP Custom Author URL < 1.0.5 - Admin+ Stored XSS
Published
2023-05-11
Title
Pinterest RSS Widget <= 2.3.1 - Contributor+ Stored Cross-Site Scripting via shortcode
Published
2025-10-02
Title
WP Photo Effects <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2025-01-16
Title
Awesome WordPress Timeline Plugin <= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting