Official Product Homepageproduct
https://blog.haao.sh/ CVE-2020-37225
MEDIUM
Powie's WHOIS Domain Check 0.9.31 Persistent Cross-Site Scripting
Record summary
CVE-2020-37225 has a selected CVSS score of 5.1 (medium); EIP currently links 1 catalogued exploit.
Description
Powie's WHOIS Domain Check 0.9.31 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by exploiting unsanitized input fields in plugin settings. Attackers can submit malicious payloads through textarea and input elements in the pwhois_settings.php configuration page to execute JavaScript in the admin context and escalate privileges.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated May 13, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
WHOIS Domain CheckBrowse Powie / WHOIS Domain Check | CVE List | 0.9.31 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBWordpress Plugin Powie's WHOIS Domain Check 0.9.31 - Persistent Cross-Site ScriptingExploitDB exploitby mqtNot analyzed1 file
References
6nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2020-37225 Official Product Homepageproduct
https://powie.de/ Product Referenceproduct
https://wordpress.org/plugins/powies-whois ExploitDB-48656exploit
https://www.exploit-db.com/exploits/48656 VulnCheck Advisory: Powie's WHOIS Domain Check 0.9.31 Persistent Cross-Site ScriptingThird-party advisory
https://www.vulncheck.com/advisories/powie-s-whois-domain-check-persistent-cross-site-scripting