CVE-2018-10101

Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.

Date published : 2018-04-14

http://www.securityfocus.com/bid/104350

https://codex.wordpress.org/Version_4.9.5