Cross-site scripting in WordPress - CVE-2017-17093

Vulnerability identifier: #VU9454

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2017-17093

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability exists due to insufficient sanitization of the language attributes used on html elements in wp-includes/general-template.php script. A remote attacker can bypass implemented filters and execute arbitrary HTML and script code in victims browser in context of the vulnerable website.

WordPress
wordpress (Debian package)

Update to version 4.9.1.

wordpress (Debian package) - addressed in versions 4.1+dfsg-1+deb8u16, 4.7.5+dfsg-2+deb9u2

• https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/

• Multiple vulnerabilities in WordPress
• Debian update for wordpress
• Cross-site scripting in WordPress WordPress