Cross-site scripting in WordPress - CVE-2017-17094
Published: November 29, 2017 / Updated: December 2, 2017
Vulnerability identifier: #VU9455
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2017-17094
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability exists due to insufficient sanitization of the attributes of enclosures in RSS and Atom feeds within wp-includes/feed.php script. A remote attacker can bypass implemented filters and execute arbitrary HTML and script code in victims browser in context of the vulnerable website.
The vulnerability exists due to insufficient sanitization of the attributes of enclosures in RSS and Atom feeds within wp-includes/feed.php script. A remote attacker can bypass implemented filters and execute arbitrary HTML and script code in victims browser in context of the vulnerable website.
Affected software
WordPress
wordpress (Debian package)
wordpress (Debian package)
How to mitigate CVE-2017-17094
Update to version 4.9.1.
wordpress (Debian package) - addressed in versions 4.1+dfsg-1+deb8u16, 4.7.5+dfsg-2+deb9u2