CVE-2018-18379: Improper Neutralization of Input During Web Page Generation

The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS...

CVE-2016-1564

Multiple cross-site scripting XSS vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a 1 stylesheet name or 2 template name to wp-admin/customize.php...

CVE-2016-1564: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a 1 stylesheet name or 2 template name to wp-admin/customize.php...

PT-2016-4861

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.4.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via a stylesheet name or template name to the "/wp-admin/customize.php" API endpoint. This can be achieved by manipulating t...