{"id":"CVE-2020-23234","aliases":["GHSA-v2f3-f8x4-m3w8"],"url":"https://o3.security/vulnerability/CVE-2020-23234","summary":"Cross Site Scripting in LavaLite CMS","details":"Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as \"ontoggle,\".","published":"2021-07-26T20:15:08.323Z","modified":"2026-07-08T19:02:20.973287Z","cvss":{"score":4.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"lavalite/cms","fixedVersion":null}],"fix":null,"references":[{"type":"EVIDENCE","url":"https://github.com/LavaLite/cms/issues/320"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T19:02:20.973287Z"}}