Description

Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.

Remediation

References

CVE-2018-10102

Related Vulnerabilities

Apache Tomcat 7PK - Security Features Vulnerability (CVE-2014-9635)

PHP Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2024-11234)

PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-3065)

XOOPS Other Vulnerability (CVE-2005-3680)

WordPress Plugin All-in-One Video Gallery Local File Inclusion (2.4.9)

Severity

Medium

Classification

CVE-2018-10102 CWE-707 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities