CVE-2018-20153

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/106220Third Party Advisory, VDB Entry
https://codex.wordpress.org/Version_4.9.9Product, Release Notes, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00019.htmlThird Party Advisory
https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/Release Notes, Vendor Advisory
https://wordpress.org/support/wordpress-version/version-5-0-1/Release Notes, Vendor Advisory
https://wpvulndb.com/vulnerabilities/9172Vendor Advisory
https://www.debian.org/security/2019/dsa-4401Third Party Advisory
https://www.zdnet.com/article/wordpress-plugs-bug-that-led-to-google-indexing-some-user-passwords/Press/Media Coverage, Third Party Advisory
http://www.securityfocus.com/bid/106220Third Party Advisory, VDB Entry
https://codex.wordpress.org/Version_4.9.9Product, Release Notes, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00019.htmlThird Party Advisory
https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/Release Notes, Vendor Advisory
https://wordpress.org/support/wordpress-version/version-5-0-1/Release Notes, Vendor Advisory
https://wpvulndb.com/vulnerabilities/9172Vendor Advisory
https://www.debian.org/security/2019/dsa-4401Third Party Advisory
https://www.zdnet.com/article/wordpress-plugs-bug-that-led-to-google-indexing-some-user-passwords/Press/Media Coverage, Third Party Advisory

Timeline

Published: Dec 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-201544.3The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.CVE-2018-201554.3The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restriction CVE-2018-201567.2The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP co CVE-2018-201577.5The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing at CVE-2018-201597.2i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated u CVE-2018-201609.8ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, CVE-2018-201616.5A design flaw in the BlinkForHome (aka Blink For Home) Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because CVE-2018-201629.9Digi TransPort LR54 4.4.0.26 and possible earlier devices have Improper Input Validation that allows users with 'super' CLI access privilege CVE-2018-201645.3An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) CVE-2018-201656.1Cross-site scripting (XSS) vulnerability in OpenText Portal 7.4.4 allows remote attackers to inject arbitrary web script or HTML via the vgn CVE-2018-201668.8A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, a CVE-2018-201677.8Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe "cat README.md" command w