CVE-2020-12707: Lepton-CMS Lepton CMS

Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days.

An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT elements. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT elements.

Affected products

• Lepton-CMS Lepton CMS: version 4.5.0 only

Published 2020-05-07. Last modified 2026-06-17.