Описание
In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.
Ссылки
- Not Applicable
- Patch
- Patch
- Third Party Advisory
- Third Party Advisory
- Mailing ListThird Party Advisory
- Release NotesVendor Advisory
- Release NotesThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Not Applicable
- Patch
- Patch
- Third Party Advisory
- Third Party Advisory
- Mailing ListThird Party Advisory
- Release NotesVendor Advisory
- Release NotesThird Party Advisory
- Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Одно из
EPSS
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
Связанные уязвимости
In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.
In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function ...
WordPress before 5.3.1 allowed an attacker to create a cross-site scripting attack (XSS) in well crafted links, because of an insufficient protection mechanism in wp_targeted_link_rel in wp-includes/formatting.php.
Уязвимость функции wp_targeted_link_rel() системы управления содержимым сайта WordPress, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю оказать воздействие на целостность данных
EPSS
6.1 Medium
CVSS3
4.3 Medium
CVSS2