Description

Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the & (ampersand) character, (2) the case of an attribute name, (3) a padded entity, and (4) an entity that is not in normalized form.

Remediation

References

CVE-2010-4536

Related Vulnerabilities

MySQL CVE-2023-22103 Vulnerability (CVE-2023-22103)

WordPress Plugin WP Maps-Display Google Maps Perfectly with Ease Multiple Cross-Site Scripting Vulnerabilities (2.3.9)

WordPress Plugin Users Ultra SQL Injection (1.5.15)

WordPress Plugin Image Slider Unspecified Vulnerability (1.1.119)

WordPress Plugin Photoracer 'id' Parameter SQL Injection (1.0)

Severity

Medium

Classification

CVE-2010-4536 CWE-707

Tags

Missing Update Known Vulnerabilities