Description

Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the & (ampersand) character, (2) the case of an attribute name, (3) a padded entity, and (4) an entity that is not in normalized form.

Remediation

References

CVE-2010-4536

Related Vulnerabilities

PHP Deserialization of Untrusted Data Vulnerability (CVE-2018-19396)

WordPress 5.5.x PHP Object Injection (5.5 - 5.5.4)

PostgreSQL Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2018-1053)

XWiki Improper Handling of Exceptional Conditions Vulnerability (CVE-2023-26479)

MySQL CVE-2015-2568 Vulnerability (CVE-2015-2568)

Severity

Medium

Classification

CVE-2010-4536 CWE-707

Tags

Missing Update Known Vulnerabilities