Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2020-35938

PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject…

High7.5EPSS 2.1%
Published
Updated
Reserved
Assigned by
mitre

Description

PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.

Timeline

  1. ID reserved

    By mitre

  2. Published

  3. · 4 years later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2020-35938, by who scored it
Scored byCVSSScoreVector
mitreCNA (assigner)3.1High7.5CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N
NVDNVD · Modified3.1High8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
2.1% · top 18% of all CVEs (7 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

Affected products

  • n/a

    • affected n/a

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2020-35938 badge
[![CVE-2020-35938](https://trackcve.app/badge/CVE-2020-35938.svg)](https://trackcve.app/cve/CVE-2020-35938)

Record last updated .