{"action":"Upgrade nodebb-plugin-blog-comments to 0.7.0 or later.","affected":[{"fixed":"0.7.0","introduced":"0"}],"component":"nodebb-plugin-blog-comments","cve_ids":["CVE-2020-15156"],"ecosystem":"npm","epss":0.00612,"exploited":false,"fixed_versions":["0.7.0"],"ghsa_id":"GHSA-43m5-c88r-cjvv","id":"tcs_01M5KEZ0F3R8KDHX2T5QB5ZP1Q","modified_at":"2026-07-08T06:00:33.812340417Z","published_at":"2020-08-26T18:55:38Z","references":["https://osv.dev/vulnerability/GHSA-43m5-c88r-cjvv","https://github.com/psychobunny/nodebb-plugin-blog-comments/security/advisories/GHSA-43m5-c88r-cjvv","https://nvd.nist.gov/vuln/detail/CVE-2020-15156","https://github.com/psychobunny/nodebb-plugin-blog-comments/commit/cf43beedb05131937ef46f365ab0a0c6fa6ac618","https://www.npmjs.com/package/nodebb-plugin-blog-comments"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-43m5-c88r-cjvv","url":"https://osv.dev/vulnerability/GHSA-43m5-c88r-cjvv"}],"summary":"XSS due to lack of CSRF validation for replying/publishing"}