CVE-2018-1000556

Name of the Vulnerable Software and Affected Versions WordPress version 4.8 and later

Description The issue allows an attacker to perform client-side attacks, potentially resulting in cookie theft or code injection, through a crafted URL with a payload that exploits a Cross Site Scripting (XSS) vulnerability in the delete function of plugins.php or core WordPress. This attack is exploitable when a victim opens the malicious link, leading to a reflected XSS attack.

Recommendations For WordPress version 4.8 and later, update to a version that contains a fix for this issue to prevent exploitation.