CVE-2020-20633

The CookieYes plugin before version 1.8.3 contained an access control vulnerability in the cli_policy_generator AJAX function that allowed low-privileged authenticated users, including subscribers, to modify any post or page by changing its status from published to draft and thereby hiding it from the website's frontend. Additionally, attackers could inject malicious code into post or page content through this same function, creating stored cross-site scripting vulnerabilities that would execute in the browsers of site visitors.

Based on public CVE data (MITRE/NVD).