Description phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php. Remediation References CVE-2020-12639 Related Vulnerabilities WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions Cross-Site Scripting (2.9.8) MediaWiki Exposure of Resource to Wrong Sphere Vulnerability (CVE-2021-35197) WordPress Plugin Inline Related Posts Multiple Cross-Site Scripting Vulnerabilities (3.0.4) Payara Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-8215) WordPress Plugin Keyword Strategy Internal Links Multiple Cross-Site Scripting Vulnerabilities (2.0) Severity Medium Classification CVE-2020-12639 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Tags Missing Update Known Vulnerabilities