CVE-2020-12054: 
WordPress vulnerability analysis and mitigation

The Catch Breadcrumb WordPress plugin before version 1.5.4 contains a Reflected Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on April 20, 2020, and was assigned CVE-2020-12054. The issue affects not only the plugin but also 16 themes by the same author when used in conjunction with the vulnerable plugin (CX Security, WPScan).

The vulnerability allows for Reflected XSS attacks via the 's' parameter, which is used for search queries. The issue received a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript code in the context of other users' browsers who visit the affected search pages. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected user's session (WPScan).

The vulnerability is exploitable without authentication, requiring only that a user visits a specially crafted URL containing malicious JavaScript in the search parameter. A proof of concept exists demonstrating the exploitation through the search functionality of affected websites (CX Security).

The vulnerability was patched in version 1.5.7 of the Catch Breadcrumb plugin. Website administrators should update to this version or later to protect against this vulnerability. Between April 23rd to 25th, 2020, various versions were released to add proper validation and sanitization of input (WPScan).