Description

wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL.

Remediation

References

CVE-2017-17094

Related Vulnerabilities

Liferay DXP Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2022-42123)

WordPress 3.7.4 Multiple Vulnerabilities (3.7 - 3.7.4)

WordPress Plugin Divi Builder PHP Code Injection (4.0.9)

WordPress 'press-this.php' Remote Security Bypass Vulnerability (0.7 - 3.1.1)

XWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-35160)

Severity

Medium

Classification

CVE-2017-17094 CWE-707 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities