CVE-2020-13869: 
PHP vulnerability analysis and mitigation

An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS (Cross-Site Scripting) via a guest name. The vulnerability was disclosed and patched in May 2020 (Craft Changelog).

The vulnerability is classified as a stored XSS issue that occurs when guest names containing potentially malicious values are not properly sanitized. The issue has been assigned a CVSS v3.1 Base Score of 5.4 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) (NVD).

The vulnerability allows attackers to inject and store malicious scripts through guest names, which could then be executed when other users view the comments. This could lead to unauthorized access to user data, session hijacking, or other client-side attacks (NVD).

The vulnerability requires an attacker to have the ability to submit comments as a guest user. The exploit can be triggered by submitting a specially crafted name containing malicious script content (Craft Changelog).

The vulnerability was patched in Comments plugin version 1.5.6. Users should upgrade to this version or later to address the security issue. The fix properly sanitizes guest names to prevent XSS attacks (Craft Changelog).