phpwarden
FeaturesComparePricingAdvisoriesBlogDocsChangelogLog in
Log inStart free

CVE-2020-11029: In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5

medium Affects WordPress core. Feed 2026.10.29.4, updated 2026-10-29; published ; advisory modified .

In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5

Package
WordPress core WordPress
Affected versions
>=3.7 and <3.7.33 or >=3.8 and <3.8.33 or >=3.9 and <3.9.31 or >=4.0 and <4.0.30 or >=4.1 and <4.1.30 or >=4.2 and <4.2.27 or >=4.3 and <4.3.23 or >=4.4 and <4.4.22 or >=4.5 and <4.5.21 or >=4.6 and <4.6.18 or >=4.7 and <4.7.17 or >=4.8 and <4.8.13 or >=4.9 and <4.9.14 or >=5.0 and <5.0.9 or >=5.1 and <5.1.5 or >=5.2 and <5.2.6 or >=5.3 and <5.3.3 or =5.4
Fixed in
3.7.33, 3.8.33, 3.9.31, 4.0.30, 4.1.30, 4.2.27, 4.3.23, 4.4.22, 4.5.21, 4.6.18, 4.7.17, 4.8.13, 4.9.14, 5.0.9, 5.1.5, 5.2.6, 5.3.3
Severity
medium  CVSS 5.8
Exploitation
not on CISA KEV · EPSS 2% (81.9th percentile)
Published
2020-04-30
Source
nvd

References

CWE-79
NVD recordWordPress core advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs   How findings are ranked

Related advisories