CVE-2020-15299: KingComposer WordPress plugin reflected XSS via AJAX preset parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityPublic exploit references and a high EPSS percentile make exploitation likely, though the medium CVSS score and required user interaction temper the severity.

What it is

KingComposer through 2.9.4 for WordPress contains a reflected cross-site scripting flaw. An attacker can craft an install_online_preset AJAX request carrying base64-encoded JavaScript in the kc-online-preset-data POST parameter, which executes in the victim's browser. It matters because the plugin was widely deployed and the flaw lets script run in the context of a logged-in victim's session.

Impact

An attacker can execute arbitrary JavaScript in the victim's browser, enabling session theft, credential capture, or actions performed as the victim. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through an AJAX request to the plugin's install_online_preset handler; no authentication is required, but the victim must be tricked into submitting the crafted request (UI:R).

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.47 (98.8th percentile) and both references are tagged Exploit, indicating public exploit detail exists. No ransomware usage is documented.

What to do

• Update KingComposer to a version later than 2.9.4, or remove the plugin if it is no longer maintained.
• If patching is not immediately possible, disable or restrict the install_online_preset AJAX action.
• Deploy a WAF rule blocking base64-encoded script payloads in the kc-online-preset-data parameter.
• Apply output encoding and input validation to the kc-online-preset-data parameter in any custom code.
• Restrict administrative and editor access to trusted users to reduce the pool of potential victims.

Detection

• Search web and proxy logs for POST requests to admin-ajax.php with action=install_online_preset and a kc-online-preset-data parameter.
• Inspect kc-online-preset-data values for base64 strings that decode to script tags or JavaScript.
• Alert on unexpected outbound requests or script execution originating from WordPress admin pages.
• Monitor for plugin version 2.9.4 or earlier across managed WordPress instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.