CVE-2018-10102 (MEDIUM 6.1) · Watchpost

← All vulnerabilities

CVE-2018-10102

MEDIUM 6.1CVE-2018-10102 · Published 16/04/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
wordpress wordpress	`< 4.9.5`	`4.9.5`

Description

Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.

References

securityfocus.com/bid/103775 · Third Party Advisory
securitytracker.com/id/1040836 · Third Party Advisory
codex.wordpress.org/Version_4.9.5 · Vendor Advisory
core.trac.wordpress.org/changeset/42893 · Patch
WordPress/WordPress commit 31a4369 · Patch
lists.debian.org/debian-lts-announce/2018/04/msg00031.html · Third Party Advisory
wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release · Third Party Advisory
wpvulndb.com/vulnerabilities/9055 · Third Party Advisory
debian.org/security/2018/dsa-4193 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free