Description

Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the & (ampersand) character, (2) the case of an attribute name, (3) a padded entity, and (4) an entity that is not in normalized form.

Remediation

References

CVE-2010-4536

Related Vulnerabilities

WordPress Plugin Paid Membership, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content-ProfilePress Cross-Site Scripting (3.1.10)

WordPress Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Vulnerability (CVE-2020-4047)

WordPress Plugin Tabs-Responsive Tabs with WooCommerce Product Tab Extension Security Bypass (3.5.4)

WordPress Plugin Seatgeek Affiliate Tickets Cross-Site Scripting (1.0.2)

Joomla! Core 2.5.x Security Bypass (2.5.0 - 2.5.2)

Severity

Medium

Classification

CVE-2010-4536 CWE-707

Tags

Missing Update Known Vulnerabilities