What this actually is.
Technical background, root cause, and affected surface.
A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted web site. The application targets your users and not the application itself, but it uses your application as the vehicle for the attack. XSS payload was executed when the user loads a malicious link generated using the ajax call back in Greenmart autocomplete search.
- Vendor
- Thembay
- Affected Product
- Greenmart version 2.4.2.
- CVE
- CVE-2020-16140
- Securin ID
- 2020-CSW-07-1045
- Status
- Fixed
- Date
- July 17, 2020
- Severity
- Medium
- CVSS Score
- 6.1
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CWE
- CWE-79
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The following vulnerability was tested on the Greenmart theme on WordPress with version 5.4.2.
Figure-07: Wp-config configuration related to protecting XSS.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
When the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content. This means that an attacker has to send a crafted malicious URL or post form to the victim to insert the payload.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Download and apply the relevant patches from the vendor:
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Reported to Vendor
Vendor Responded
Vendor Released Fixed
CVE Assigned
Disclosed 1 day after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.