Vulnerability identifier: #VU9455

Vulnerability risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-17094

CWE-ID: CWE-79

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
WordPress
Web applications / CMS

Vendor: WordPress.ORG

Description
The vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability exists due to insufficient sanitization of the attributes of enclosures in RSS and Atom feeds within wp-includes/feed.php script. A remote attacker can bypass implemented filters and execute arbitrary HTML and script code in victims browser in context of the vulnerable website.

Mitigation
Update to version 4.9.1.

Vulnerable software versions

WordPress: 3.7 - 3.7.23, 3.8 - 3.8.23, 3.9 - 3.9.21, 4.0 - 4.0.20, 4.4 - 4.4.13, 4.1 - 4.1.20, 4.2 - 4.2.17, 4.3 - 4.3.13, 4.5 - 4.5.11, 4.6 - 4.6.8, 4.7 - 4.7.7, 4.8 - 4.8.3, 4.9

---

External links
http://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.