WordPress · Report #249759
Lack of Sanitization and Insufficient Authentication
Validstatus
mediumseverity
11upvotes
26 Dec 2017disclosed
Summary
The language_attributes() function was not escaping output, which could lead to an XSS vulnerability if combined with other vulnerabilities.
To fix that, the output was passed through esc_attr() in r42259, which was part of the 4.9.1 release.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.