CVE-2018-5776: WordPress

Medium severity, CVSS 6.1. EPSS: 2% chance of exploitation in the next 30 days.

WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).

Affected products

• WordPress WordPress: before 4.9.2 (fixed in 4.9.2)

Published 2018-01-18. Last modified 2026-06-17.