In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.

Fix status by distribution

Fixed packages published by each distribution for this CVE

• Debian DEBIAN-CVE-2018-20150 wordpress Fixed in: 5.0.1+dfsg1-1

References

• advisory securityfocus.com
• advisory codex.wordpress.org
• advisory lists.debian.org
• advisory wordpress.org
• advisory wordpress.org
• advisory wpvulndb.com
• advisory debian.org
• advisory zdnet.com
• patch github.com