CVE-2020-26669: Bigtreecms Bigtree CMS

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

A stored cross-site scripting (XSS) vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update.

Affected products

• Bigtreecms Bigtree CMS: up to and including 4.4.10

Published 2021-06-01. Last modified 2026-06-17.