CVE-2010-4536

Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the & (ampersand) character, (2) the case of an attribute name, (3) a padded entity, and (4) an entity that is not in normalized form.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

3.45% chance of exploitation in the next 30 days, 88th percentile

Nuclei

medium

Published

2011-01-03

Updated

2024-08-07

Nuclei templates (1)

• topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2010/CVE-2010-4536-wordpress-2a…

References

• CVE Record
• NVD entry

Related

• CVE-2010-4524
• CVE-2010-4538
• CVE-2010-4523
• CVE-2010-4539
• CVE-2010-4518
• CVE-2010-4540