CVE-2020-15020: 
WordPress vulnerability analysis and mitigation

An issue was discovered in the Elementor plugin through version 2.9.13 for WordPress. The vulnerability (CVE-2020-15020) involves a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated attacker to inject malicious scripts via the 'Name Your Template' field (WPScan, CVE).

The vulnerability stems from improper sanitization of the template name field when it is output back to users. The issue was assigned a CVSS score of 6.6 (medium severity). The vulnerability was fixed in version 2.9.14 of the Elementor plugin (WPScan).

When exploited, this vulnerability allows authenticated attackers to store and execute malicious JavaScript code that would run in the context of other users viewing the affected template name. This could potentially lead to session hijacking, credential theft, or other client-side attacks (WPScan).

The vulnerability can be exploited by accessing the templates tab, clicking on 'add new', selecting page or section, and then inserting XSS payload such as malicious script tags in the 'name your template' field. The attack requires authentication, meaning the attacker must have valid credentials to access the template creation functionality (WPScan).

Users should update their Elementor plugin to version 2.9.14 or later, which contains the fix for this vulnerability. The update properly sanitizes the template name field to prevent XSS attacks (WPScan).