CVE-2020-24316

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-08-26 · updated 2026-06-17
Weakness: CWE-79

Description

WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.

Affected products

Admin Menu Project Admin Menu: through 1.1

References

https://wordpress.org/plugins/admin-menu/
https://zeroaptitude.com/zerodetail/wordpress-plugin-bug-hunting-part-1/
https://wordpress.org/plugins/admin-menu/
https://zeroaptitude.com/zerodetail/wordpress-plugin-bug-hunting-part-1/

Get alerted when CVE-2020-24316 or the next vulnerability affects your stack