CVE-2018-5776

score

<0.1

cvss

6.1

epss

2.0%

published

2018-01-18

kev added

—

first seen

2026-10-21

WordPress before 4.9.2 contains a reflected cross-site scripting caused by unsanitized input in the Flash fallback files within wp-includes/js/mediaelement, letting attackers execute arbitrary scripts in the context of the victim's browser, exploit requires victim to load malicious content.