CVE-2020-15299: 
WordPress vulnerability analysis and mitigation

A reflected Cross-Site Scripting (XSS) vulnerability was discovered in the KingComposer WordPress plugin versions through 2.9.4, identified as CVE-2020-15299. The vulnerability was disclosed on June 25, 2020, and affects approximately 100,000 WordPress sites. This security flaw allows remote attackers to execute malicious JavaScript code in victims' browsers through specially crafted AJAX requests (Wordfence Blog).

The vulnerability is classified as a reflected XSS (CWE-79) with a CVSS v3.1 base score of 6.1 (Medium). The attack vector involves tricking users into submitting an install_online_preset AJAX request containing base64-encoded JavaScript within the kc-online-preset-data POST parameter. The vulnerability requires user interaction and has a network attack vector, with low attack complexity and no privileges required (NVD).

When successfully exploited, this vulnerability allows attackers to execute arbitrary JavaScript code in the victim's browser context. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed under the context of the authenticated user (NVD).

The vulnerability requires user interaction to exploit, as indicated by the CVSS metrics. The attacker needs to trick a victim into submitting a specifically crafted AJAX request. The attack complexity is rated as low, indicating that the vulnerability is relatively straightforward to exploit once the user interaction is achieved (NVD).

A patch was released to address this vulnerability. Website administrators running the KingComposer plugin should update to a version newer than 2.9.4. Wordfence security plugin users received protection through firewall rules, with premium users getting immediate protection and free version users receiving the rule after 30 days, on July 15, 2020 (Wordfence Blog).