Description
ext/filter in PHP 5.2.0, when FILTER_SANITIZE_STRING is used with the FILTER_FLAG_STRIP_LOW flag, does not properly strip HTML tags, which allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML with a '<' character followed by certain whitespace characters, which passes one filter but is collapsed into a valid tag, as demonstrated using %0b.
Remediation
References
Related Vulnerabilities
WordPress Plugin Better Click To Tweet Unspecified Vulnerability (5.1)
PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2007-5899)
WebLogic CVE-2021-2376 Vulnerability (CVE-2021-2376)
WordPress Plugin Responsive Menu-Create Mobile-Friendly Menu Multiple Vulnerabilities (4.0.3)
WordPress Plugin Cart All In One For WooCommerce Cross-Site Request Forgery (1.1.10)