WordPress core
CVE-2018-20149
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
- Severity
- Medium 5.4
- Published
- 14 Dec 2018
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 17 Oct 2026
- Fixed in
- 4.9.9, 5.0.1
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
WordPressWordPress core · cpe:a:wordpress:wordpress |
|