CVE-2018-10102: Debian Linux

Medium severity, CVSS 6.1. EPSS: 4.3% chance of exploitation in the next 30 days.

Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• WordPress WordPress: before 4.9.5 (fixed in 4.9.5)

Published 2018-04-16. Last modified 2026-06-17.