VDB
CVE-2018-20149
CVE-2018-20149
PUBLISHED
CVSS 5.400000095367432 MEDIUM
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
EPSS 2.89% · 85.9th percentile
Risk Scores
CVSS 3.0
5.400000095367432
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS Score
2.89%
85.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | wordpress | 0, 4.3+dfsg-1, 4.4+dfsg-1 |
| Ubuntu:18.04:LTS | wordpress | 0, 4.8.2+dfsg-2, 4.8.3+dfsg-1 |
Timeline
- Dec 14, 2018 CVE Published
- Apr 14, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- May 14, 2022 CVE Updated
- Mar 17, 2025 EPSS Score
- Mar 19, 2025 EPSS Score
- Mar 23, 2025 EPSS Score
- Mar 29, 2025 EPSS Score
- Mar 30, 2025 EPSS Score
- May 1, 2025 EPSS Score
- Jun 1, 2025 EPSS Score
- Jun 4, 2025 EPSS Score
References
- https://ubuntu.com/security/CVE-2018-20149 third-party-advisory
- https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/ third-party-advisory
- https://github.com/WordPress/WordPress/commit/246a70bdbfac3bd45ff71c7941deef1bb206b19a third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2018-20149 third-party-advisory