CVE-2018-10102

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/103775Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040836Third Party Advisory, VDB Entry
https://codex.wordpress.org/Version_4.9.5Vendor Advisory
https://core.trac.wordpress.org/changeset/42893Patch, Third Party Advisory
https://github.com/WordPress/WordPress/commit/31a4369366d6b8ce30045d4c838de2412c77850dPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/04/msg00031.htmlThird Party Advisory
https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/Third Party Advisory
https://wpvulndb.com/vulnerabilities/9055Third Party Advisory, VDB Entry
https://www.debian.org/security/2018/dsa-4193Third Party Advisory
http://www.securityfocus.com/bid/103775Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040836Third Party Advisory, VDB Entry
https://codex.wordpress.org/Version_4.9.5Vendor Advisory
https://core.trac.wordpress.org/changeset/42893Patch, Third Party Advisory
https://github.com/WordPress/WordPress/commit/31a4369366d6b8ce30045d4c838de2412c77850dPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/04/msg00031.htmlThird Party Advisory
https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/Third Party Advisory
https://wpvulndb.com/vulnerabilities/9055Third Party Advisory, VDB Entry
https://www.debian.org/security/2018/dsa-4193Third Party Advisory

Timeline

Published: Apr 16, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-101039.8tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2).CVE-2018-101059.8tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2).CVE-2018-101069.8D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have permission bypass and information disclosure CVE-2018-101076.1D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the RESULT parameter to /htdocs/webin CVE-2018-101086.1D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the Treturn parameter to /htdocs/webi CVE-2018-101094.8Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the content secti CVE-2018-10117.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "CVE-2018-101104.8D-Link DIR-615 T1 devices allow XSS via the Add User feature.CVE-2018-101117.5An issue was discovered in GEGL through 0.3.32. The render_rectangle function in process/gegl-processor.c has unbounded memory allocation, l CVE-2018-101128.8An issue was discovered in GEGL through 0.3.32. The gegl_tile_backend_swap_constructed function in buffer/gegl-tile-backend-swap.c allows re CVE-2018-101137.5An issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm-load.c has unbounded memory allocation, lead CVE-2018-101148.8An issue was discovered in GEGL through 0.3.32. The gegl_buffer_iterate_read_simple function in buffer/gegl-buffer-access.c allows remote at