Description

Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.

Remediation

References

CVE-2018-10101

Related Vulnerabilities

WordPress Plugin Simple Social Media Share Buttons-Social Sharing for Everyone Cross-Site Scripting (3.2.2)

FluxBB Use of Password Hash With Insufficient Computational Effort Vulnerability (CVE-2020-28873)

Jboss EAP Deserialization of Untrusted Data Vulnerability (CVE-2019-10086)

Joomla! Core 3.3.x Denial of Service (3.3.0 - 3.3.4)

PHP Out-of-bounds Read Vulnerability (CVE-2015-2325)

Severity

Medium

Classification

CVE-2018-10101 CWE-601 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities