CVE-2018-20150
published 2018-12-14CVE-2018-20150: In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
PriorityP430medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
5.05%
91.4th percentile
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | wordpress | < wordpress 5.0.1+dfsg1-1 (bookworm) | wordpress 5.0.1+dfsg1-1 (bookworm) |
| wordpress | wordpress | < 4.9.9 | 4.9.9 |
| wordpress | wordpress | >= 0 < 5.0.1+dfsg1-1 | 5.0.1+dfsg1-1 |
| wordpress | wordpress | >= 0 < 5.0.1+dfsg1-1 | 5.0.1+dfsg1-1 |
| wordpress | wordpress | >= 0 < 5.0.1+dfsg1-1 | 5.0.1+dfsg1-1 |
| wordpress | wordpress | >= 0 < 5.0.1+dfsg1-1 | 5.0.1+dfsg1-1 |
| wordpress | wordpress | >= 5.0 < 5.0.1 | 5.0.1 |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_debian6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f844-ppv9-vxhv: In WordPress before 4
ghsa_unreviewed·2022-05-14
CVE-2018-20150 [MEDIUM] CWE-79 GHSA-f844-ppv9-vxhv: In WordPress before 4
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
OSV
CVE-2018-20150: In WordPress before 4
osv·2018-12-14·CVSS 6.1
CVE-2018-20150 [MEDIUM] CVE-2018-20150: In WordPress before 4
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
Debian
CVE-2018-20150: wordpress - In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS f...
vendor_debian·2018·CVSS 6.1
CVE-2018-20150 [MEDIUM] CVE-2018-20150: wordpress - In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS f...
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
Scope: local
bookworm: resolved (fixed in 5.0.1+dfsg1-1)
bullseye: resolved (fixed in 5.0.1+dfsg1-1)
forky: resolved (fixed in 5.0.1+dfsg1-1)
sid: resolved (fixed in 5.0.1+dfsg1-1)
trixie: resolved (fixed in 5.0.1+dfsg1-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/106220https://codex.wordpress.org/Version_4.9.9https://github.com/WordPress/WordPress/commit/fb3c6ea0618fcb9a51d4f2c1940e9efcd4a2d460https://lists.debian.org/debian-lts-announce/2019/02/msg00019.htmlhttps://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/https://wordpress.org/support/wordpress-version/version-5-0-1/https://wpvulndb.com/vulnerabilities/9173https://www.debian.org/security/2019/dsa-4401https://www.zdnet.com/article/wordpress-plugs-bug-that-led-to-google-indexing-some-user-passwords/http://www.securityfocus.com/bid/106220https://codex.wordpress.org/Version_4.9.9https://github.com/WordPress/WordPress/commit/fb3c6ea0618fcb9a51d4f2c1940e9efcd4a2d460https://lists.debian.org/debian-lts-announce/2019/02/msg00019.htmlhttps://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/https://wordpress.org/support/wordpress-version/version-5-0-1/https://wpvulndb.com/vulnerabilities/9173https://www.debian.org/security/2019/dsa-4401https://www.zdnet.com/article/wordpress-plugs-bug-that-led-to-google-indexing-some-user-passwords/
2018-12-14
Published