CVE-2020-36510: 15Zine < 3.3.0 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-28 · updated 2026-06-17
Weakness: CWE-79

Description

The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s_a AJAX action, leading to a Reflected Cross-Site Scripting

Affected products

15Zine: before 3.3.0 — fixed in 3.3.0

How to fix

Upgrade to a fixed version: 15Zine 3.3.0. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/d1dbc6d7-7488-40c2-bc38-0674ea5b3c95
https://wpscan.com/vulnerability/d1dbc6d7-7488-40c2-bc38-0674ea5b3c95

Get alerted when CVE-2020-36510 or the next vulnerability affects your stack