CVE-2018-18069

Published: 2018-10-08T22:29Z

Last Modified: 2024-11-21T03:55Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt