CVE-2020-4046

score

<0.1

cvss

5.4

epss

2.1%

published

2020-06-12

kev added

—

first seen

2026-10-21

WordPress versions prior to 5.4.2 contain a cross-site scripting caused by unfiltered HTML injection via the embed block in the editor, letting low-privilege users inject scripts that can execute when viewed by higher privileged users, exploit requires use of the embed block by low-privilege users.