blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2020-12054

MEDIUM 6.1 CVSS 3.1
Published
April 23, 2020
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.

Affected products and versions

  • n/a n/a — Versions not specified
  • catchplugins catch_breadcrumb — Before 1.5.4

References

  • cxsecurity.com https://cxsecurity.com/issue/WLB-2020040144 Exploit, Third Party Advisory
  • wpvulndb.com https://wpvulndb.com/vulnerabilities/10184 Third Party Advisory
  • nvd.nist.gov Official NVD record