Description
Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.
Remediation
References
Related Vulnerabilities
WordPress Plugin Bootstrap Categories Gallery Cross-Site Scripting (1.0.1)
MySQL CVE-2017-3633 Vulnerability (CVE-2017-3633)
Jboss EAP Deserialization of Untrusted Data Vulnerability (CVE-2016-3690)
WordPress Plugin WP Plugin Manager (WPPM) Cross-Site Scripting (1.6.4.b)
WordPress Plugin Videox7 UGC 'listid' Parameter Cross-Site Scripting (2.5.3.2)