WordPress CVEs

Description

Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.

Affected WordPress components

• WordPress core
  Confirmed match
  Up to and including 4.8.1

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wordpress wordpress — Up to and including 4.8.1

References

• www.securityfocus.com http://www.securityfocus.com/bid/100912 Third Party Advisory, VDB Entry
• www.securitytracker.com http://www.securitytracker.com/id/1039553
• core.trac.wordpress.org https://core.trac.wordpress.org/changeset/41412 Patch, Vendor Advisory
• wordpress.org https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/ Patch, Release Notes, Vendor Advisory
• www.debian.org https://www.debian.org/security/2017/dsa-3997
• nvd.nist.gov Official NVD record