LiveActive security incident?Get immediate response
CVE Record

CVE-2020-28707: The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) v...

The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage() event is not validated. The stockdio_eventer function listens for any postMessage event. After a message event is sent to the application, this function sets the "e" variable as the event and checks that the types of the data and data.method are not undefined (empty) before proceeding to eval the data.method received from the postMessage. However, on a different website. JavaScript code can call window.open for the vulnerable WordPress instance and do a postMessage(msg,'*') for that object.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2020-28707 affects the Stockdio Historical Chart WordPress plugin before 2.8.1. A vulnerable site could run attacker-controlled JavaScript because the plugin accepted browser postMessage events without validating their origin, then evaluated supplied method data.

Executive priority

Treat as a targeted web risk, not a confirmed emergency. Prioritize internet-facing WordPress sites using this plugin, especially sites with administrative users or customer sessions, because XSS can undermine browser trust and site integrity.

Technical view

The vulnerable JavaScript file stockdio_chart_historical-wp.js registers stockdio_eventer for postMessage events from any origin. If message data and data.method exist, the code evaluates data.method. The CVE description states another website can open the vulnerable WordPress instance and send a postMessage using '*'.

Likely exposure

Exposure is limited to WordPress sites running Stockdio Historical Chart before 2.8.1 and loading the vulnerable asset. The source bundle does not identify affected CPEs, deployment prevalence, or whether authentication is required.

Exploitation context

The bundle does not show KEV listing or active exploitation. The described path requires a crafted cross-site browser interaction against a vulnerable WordPress page that loads the plugin JavaScript. No exploit steps should be inferred beyond that.

Researcher notes

Evidence is sparse: no CVSS, CWE, CPE, or KEV signal is provided. The core issue is missing postMessage origin validation combined with eval of message-controlled data.method in plugin JavaScript before 2.8.1.

Mitigation direction

  • Check whether Stockdio Historical Chart is installed on WordPress sites.
  • Upgrade from versions before 2.8.1 to a non-affected version.
  • If upgrade is not possible, disable the plugin pending vendor guidance.
  • Review vendor and WordPress plugin pages for current remediation notes.

Validation and detection

  • Inventory WordPress plugins and identify Stockdio Historical Chart versions.
  • Confirm whether pages load stockdio_chart_historical-wp.js from the plugin assets directory.
  • Verify the installed version is 2.8.1 or later.
  • Check security monitoring for unexplained script execution on affected pages.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-28707 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.