Description
Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a widget title.
Remediation
References
Related Vulnerabilities
WordPress Plugin NextGEN Gallery-WordPress Gallery Arbitrary File Upload (1.9.12)
WordPress Plugin Tutor LMS-eLearning and online course solution SQL Injection (1.8.2)
Liferay DXP Insecure Default Initialization of Resource Vulnerability (CVE-2024-26267)
Jenkins Integer Overflow or Wraparound Vulnerability (CVE-2023-36478)
Apache HTTP Server Session Fixation Vulnerability (CVE-2001-1534)