CVE-2020-35937
📋 TL;DR
This stored XSS vulnerability in the Team Showcase WordPress plugin allows remote authenticated attackers to inject malicious JavaScript via AJAX requests. Attackers can import layouts containing harmful scripts that execute when viewed by other users. WordPress sites using vulnerable versions of the Team Showcase plugin are affected.
💻 Affected Systems
- Team Showcase WordPress Plugin
📦 What is this software?
Post Grid by Pickplugins
Team Showcase by Pickplugins
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or establish persistent backdoors leading to complete site compromise.
Likely Case
Attackers with authenticated access could inject malicious scripts that steal user session cookies, perform actions on behalf of users, or display fraudulent content.
If Mitigated
With proper input validation and output encoding, malicious scripts would be neutralized before execution, preventing successful exploitation.
🎯 Exploit Status
Exploitation requires authenticated user access. The vulnerability is well-documented with proof-of-concept available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.22.16 and later
Vendor Advisory: https://wordpress.org/plugins/team-showcase/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Team Showcase plugin. 4. Click 'Update Now' if update available. 5. If no update available, download version 1.22.16+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable AJAX Import Functionality
allTemporarily disable the vulnerable AJAX endpoint that handles layout imports
Add to theme's functions.php: add_filter('wp_ajax_team_import_xml_layouts', '__return_false');
Restrict User Roles
allLimit which user roles can access plugin functionality
Use WordPress role management plugins to restrict access to Team Showcase features
🧯 If You Can't Patch
- Disable or remove the Team Showcase plugin entirely
- Implement web application firewall (WAF) rules to block requests containing suspicious JavaScript in source parameter
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Team Showcase → Version. If version is below 1.22.16, system is vulnerable.Check Version:
wp plugin list --name=team-showcase --field=versionVerify Fix Applied:
After updating, verify version is 1.22.16 or higher. Test AJAX import functionality with safe test payloads.📡 Detection & Monitoring
Log Indicators:
- AJAX requests to wp-admin/admin-ajax.php with action=team_import_xml_layouts containing JavaScript in parameters
- Unusual import activities from authenticated users
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with team_import_xml_layouts action and script tags in payload
SIEM Query:
source="wordpress" AND uri="/wp-admin/admin-ajax.php" AND (action="team_import_xml_layouts" OR params CONTAINS "team_import_xml_layouts") AND (params CONTAINS "<script" OR params CONTAINS "javascript:")