CVE-2018-10101

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/104350Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040836Third Party Advisory, VDB Entry
https://codex.wordpress.org/Version_4.9.5Vendor Advisory
https://core.trac.wordpress.org/changeset/42894Patch, Vendor Advisory
https://github.com/WordPress/WordPress/commit/804363859602d4050d9a38a21f5a65d9aec18216Patch, Third Party Advisory
https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/Vendor Advisory
https://wpvulndb.com/vulnerabilities/9053Third Party Advisory
https://www.debian.org/security/2018/dsa-4193Third Party Advisory
http://www.securityfocus.com/bid/104350Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040836Third Party Advisory, VDB Entry
https://codex.wordpress.org/Version_4.9.5Vendor Advisory
https://core.trac.wordpress.org/changeset/42894Patch, Vendor Advisory
https://github.com/WordPress/WordPress/commit/804363859602d4050d9a38a21f5a65d9aec18216Patch, Third Party Advisory
https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/Vendor Advisory
https://wpvulndb.com/vulnerabilities/9053Third Party Advisory
https://www.debian.org/security/2018/dsa-4193Third Party Advisory

Timeline

Published: Apr 16, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-101026.1Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.CVE-2018-101039.8tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2).CVE-2018-101059.8tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2).CVE-2018-101069.8D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have permission bypass and information disclosure CVE-2018-101076.1D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the RESULT parameter to /htdocs/webin CVE-2018-101086.1D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the Treturn parameter to /htdocs/webi CVE-2018-101094.8Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the content secti CVE-2018-10117.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "CVE-2018-101104.8D-Link DIR-615 T1 devices allow XSS via the Add User feature.CVE-2018-101117.5An issue was discovered in GEGL through 0.3.32. The render_rectangle function in process/gegl-processor.c has unbounded memory allocation, l CVE-2018-101128.8An issue was discovered in GEGL through 0.3.32. The gegl_tile_backend_swap_constructed function in buffer/gegl-tile-backend-swap.c allows re CVE-2018-101137.5An issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm-load.c has unbounded memory allocation, lead