wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file.

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities :

 - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.

 - wp-includes/functions.php does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file.

 - wp-includes/general-template.php does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.

 - wp-includes/feed.php does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform SQL injections and various Cross-Side Scripting (XSS) and Server-Side Request Forgery (SSRF) attacks, as well as bypass some access restrictions.

Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following issues.

CVE-2017-17091

wp-admin/user-new.php in WordPress sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.

CVE-2017-17092

wp-includes/functions.php in WordPress does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file.

CVE-2017-17093

wp-includes/general-template.php in WordPress does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.

CVE-2017-17094

wp-includes/feed.php in WordPress does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL.

For Debian 7 'Wheezy', these problems have been fixed in version 3.6.1+dfsg-1~deb7u20.

We recommend that you upgrade your wordpress packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.9.1.
It is, therefore, affected by multiple vulnerabilities.

ID	Name	Product	Family	Severity
98330	WordPress 3.7.x < 3.7.24 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98329	WordPress 3.8.x < 3.8.24 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98328	WordPress 3.9.x < 3.9.22 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98327	WordPress 4.0.x < 4.0.21 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98326	WordPress 4.1.x < 4.1.21 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98325	WordPress 4.2.x < 4.2.18 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98324	WordPress 4.3.x < 4.3.14 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98323	WordPress 4.4.x < 4.4.13 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98322	WordPress 4.5.x < 4.5.12 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98321	WordPress 4.6.x < 4.6.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98320	WordPress 4.7.x < 4.7.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98319	WordPress 4.8.x < 4.8.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98318	WordPress 4.9.x < 4.9.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
106109	Debian DSA-4090-1 : wordpress - security update	Nessus	Debian Local Security Checks	critical
105423	Debian DLA-1216-1 : wordpress security update	Nessus	Debian Local Security Checks	high
105004	WordPress < 4.9.1 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2017-17092

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

high