Cross-site scripting in WordPress - CVE-2017-6814

Detailed vulnerability description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability is caused by incorrect filtration of input data passed via playlist shortcode in the wp_playlist_shortcode() function in wp-includes/media.php and via the meta information in the renderTracks() function in wp-includes/js/mediaelement/wp-playlist.js. A remote attacker can inject arbitrary HTML and script code and execute it in victim’s browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

How to mitigate CVE-2017-6814

Sources

• https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/