CVE-2018-5776: Improper Neutralization of Input During Web Page Generation

WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement under wp-includes/js/mediaelement...