wordpress is vulnerable to cross-site scripting (XSS). The attack is due to not handling of the existing rel
attribute in wp_rel_nofollow_calback()
, allowing an attacker to inject arbitrary script during shortcode previews.
fortiguard.com/zeroday/FG-VD-18-165
lists.debian.org/debian-lts-announce/2019/10/msg00023.html
seclists.org/bugtraq/2020/Jan/8
wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/
wpvulndb.com/vulnerabilities/9864
www.debian.org/security/2020/dsa-4599
www.debian.org/security/2020/dsa-4677