wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
http://www.cvedetails.com/cve/CVE-2011-4957/
http://core.trac.wordpress.org/changeset/20493/branches/3.3
This vulnerability affects the following application versions:
- WordPress 3.1
- WordPress 3.1.1
- WordPress 3.1.2
- WordPress 3.1.3
- WordPress 3.2
- WordPress 3.2.1
- WordPress 3.3
- WordPress 3.3.1