CVE-2020-23234

4.8 mediumEPSS 0.6%

Medium (4.8) in lavalite lavalite. EPSS 0.6% chance of exploitation in the next 30 days.

Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-07-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

lavalite:lavalite

References

https://github.com/LavaLite/cms/issues/320
https://github.com/LavaLite/cms/issues/320

Check your stack JSON