CVE-2020-29247
MediumCVSS 4.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
WonderCMS 3.1.3 is vulnerable to cross-site scripting (XSS) in the Admin Panel. An attacker can inject a malicious JavaScript payload in the Page keywords field, which triggers on every visit to the website, allowing theft of session cookies.
Risk Assessment
The risk involves potential session hijacking of administrators or other users, leading to unauthorized access to the admin panel and website content modification.
Recommendation
Immediately update WonderCMS to the latest version and implement input sanitization for form fields in the admin panel.
Original NVD description (English source)
WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel. An attacker can inject the XSS payload in Page keywords and each time any user will visit the website, the XSS triggers, and the attacker can able to steal the cookie according to the crafted payload.