XSS in platform
Priority LOW 36CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS vulnerability is possible. The issue was introduced in 9.0.0 and fixed in 9.4.4.
Why it matters now
EPSS 0.00748 55th percentileScored 2026-11-07
Fix Fixed platform (orchidsoftware): 9.4.4orchid/platform (Packagist): 9.4.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| orchidsoftware | platform | 9.0.0 to before 9.4.4 | 9.4.4 | Patch available | CNA |
| — | orchid/platform (Packagist) | 9.0.0 to before 9.4.4 | 9.4.4 | Patch available | GHSA-589w-hccm-265x |
- platform Vendororchidsoftware Affected 9.0.0 to before 9.4.4 Fixed in 9.4.4 Patch available CNA
- orchid/platform (Packagist) Vendor— Affected 9.0.0 to before 9.4.4 Fixed in 9.4.4 Patch available GHSA-589w-hccm-265x
Remediation
- Fix · CNA platform (orchidsoftware) Fixed in 9.4.4
- Fix · GHSA-589w-hccm-265x orchid/platform (Packagist) Fixed in 9.4.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15263
- 2026-10-03 Alias added: GHSA-589w-hccm-265x
References
More orchidsoftware vulnerabilities
- TI-2024-34880 Method Exposure Vulnerability in Modals in orchid/platform CVSS 3.1MEDIUM 4.1
Sources
- CVE-2020-15263 · CVE Program
- CVE-2020-15263 · NVD
- FIRST EPSS
- GHSA-589w-hccm-265x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences