Description
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.
Remediation
References
Related Vulnerabilities
WordPress Plugin Support Ticket System Multiple SQL Injection Vulnerabilities (1.2)
WordPress Plugin Visual Form Builder Cross-Site Scripting (3.0.3)
WordPress Plugin Video Conferencing with Zoom Information Disclosure (3.8.16)
WordPress 3.0.3 KSES Library Cross-Site Scripting Vulnerability (0.6.2 - 3.0.3)