Security readout for executives and security teams
Plain-English summary
CVE-2018-10752 is a stored cross-site scripting issue in Tagregator plugin 0.6 for WordPress. Content entered in the Add New title field may be stored and later rendered unsafely. This could let an attacker affect users who view the stored content, including administrators, depending on site permissions.
Executive priority
Treat this as a targeted WordPress plugin exposure item. Prioritize internet-facing sites and sites where many users can create content. Urgency is moderate because stored XSS can affect privileged viewers, but the provided sources do not show active exploitation or severity scoring.
Technical view
The source bundle describes stored XSS in WordPress Tagregator plugin 0.6 via the title field in an Add New action. No CVSS, CWE, fixed version, or authentication requirements are provided. Exploit-DB and Pastebin references are listed, but the bundle does not establish active exploitation.
Likely exposure
Likely exposed assets are WordPress sites running Tagregator plugin 0.6, especially where untrusted or lower-privileged users can access the Add New workflow containing the title field.
Exploitation context
A public Exploit-DB reference exists, indicating public technical awareness. The CVE is not marked KEV, and the provided sources do not state active exploitation in the wild.
Researcher notes
Evidence is sparse. The record names Tagregator 0.6 and the Add New title field but omits CVSS, CWE, affected CPEs, fix status, and privilege requirements. Validate exposure through asset inventory and plugin-state review before assuming business impact.
Mitigation direction
- Inventory WordPress sites for Tagregator plugin 0.6.
- Disable or remove Tagregator where it is not required.
- Check vendor or WordPress plugin guidance for a fixed version or replacement.
- Restrict access to affected Add New workflows until remediation is confirmed.
- Review stored titles for unexpected script-like content.
Validation and detection
- Confirm whether Tagregator 0.6 is installed on any WordPress assets.
- Identify who can access the affected Add New title field.
- Verify the vulnerable plugin version is removed, disabled, or updated.
- Review rendered stored titles for unsafe behavior or unexpected markup.
- Check logs for unusual Add New activity involving title changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-10752 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- 45225CVE reference · exploit, x_refsource_EXPLOIT-DB
- https://pastebin.com/ZGr5tyP2CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.