Powie's WHOIS Domain Check 0.9.31 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by exploi…

Code

The project this record applies to. Exploit listings stay in References.

• Plugin source · wordpress.org

Timeline

Detection, updates, and resolution for this record.

1. May 13, 2026 · NIST NVD

   Detected

   Powie's WHOIS Domain Check 0.9.31 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by exploiting unsanitized input fields in plugin settings. Attackers can submit malicious payloads through textarea and input elements in the pwhois_settings.php configuration page to execute JavaScript in the admin context and escalate privi

2. Jun 17, 2026 · NIST NVD

   Updated

   Powie's WHOIS Domain Check 0.9.31 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by exploiting unsanitized input fields in plugin settings. Attackers can submit malicious payloads through textarea and input elements in the pwhois_settings.php configuration page to execute JavaScript in the admin context and escalate privi

Sources

• CVE.orgVulnerability recordCVE-2020-37225

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2020-37225

  Powie's WHOIS Domain Check 0.9.31 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by exploiting unsanitized input fields in plugin settings. Attackers can submit malicious payloads through textarea and in

  nvd.nist.gov

References

• Reference · blog.haao.sh
• Reference · powie.de
• Reference · wordpress.org
• Reference · exploit-db.com
• Reference · vulncheck.com