Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt.

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities :

 - An information disclosure vulnerability exists in the class-wp-press-this.php script due to a failure to properly restrict the user interface for assigning taxonomy terms. An authenticated, remote attacker can exploit this to disclose sensitive information. (CVE-2017-5610)

 - A SQL injection (SQLi) vulnerability exists in the class-wp-query.php script due to a failure to sanitize input to post type names. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or manipulation of arbitrary data. (CVE-2017-5611)

 - A cross-site scripting (XSS) vulnerability exists in the class-wp-posts-list-table.php script due to improper validation of input to the posts list table. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-5612)

 - A privilege escalation vulnerability exists in the REST API due to a failure to properly sanitize user-supplied input to the 'id' parameter when editing or deleting blog posts. An unauthenticated, remote attacker can exploit this issue to run arbitrary PHP code, inject content into blog posts, modify blog post attributes, or delete blog posts. (CVE-2017-1001000)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of WordPress prior to 4.7.2 are affected by multiple vulnerabilities :

 - A flaw exists in the 'wp-admin/includes/class-wp-press-this.php' script that is triggered as the user interface for assigning taxonomy terms is exposed to users, who do not have permission to use it.  This may allow an authenticated, remote attacker to gain unauthorized acces to sensitive information.
 - A flaw exists that may allow carrying out an SQL injection attack.  The issue is due to the 'wp-includes/class-wp-query.php' script not properly sanitizing input to post type names before using it in SQL queries.  This may potentially allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data. 
 - A flaw exists that allows a cross-site scripting (XSS) attack.  This flaw exists because the 'wp-admin/includes/class-wp-posts-list-table.php' script does not properly validated input to posts list table excerpts before returning it to users.  This may allow a remote attacker to create a specially crafted request that will execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
 - A flaw exists in the '/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php' script that is due to a failure to securely perform permission checks.  This may allow a remote attacker to change the content of arbitrary posts or pages.

Several vulnerabilities were discovered in wordpress, a web blogging tool. They would allow remote attackers to hijack victims' credentials, access sensitive information, execute arbitrary commands, bypass read and post restrictions, or mount denial-of-service attacks.

Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following issues.

CVE-2017-5488

Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the name or version header of a plugin.

CVE-2017-5489

Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vectors involving a Flash file upload.

CVE-2017-5490

Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php.

CVE-2017-5491

wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.

CVE-2017-5492

Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php and wp-admin/widgets.php.

CVE-2017-5493

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted site signup or user signup.

CVE-2017-5610

wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms.

CVE-2017-5611

SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name.

CVE-2017-5612

Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt.

For Debian 7 'Wheezy', these problems have been fixed in version 3.6.1+dfsg-1~deb7u13.

We recommend that you upgrade your wordpress packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.7.2.
It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     class-wp-press-this.php script due to a failure to     properly restrict the user interface for assigning     taxonomy terms. An authenticated, remote attacker can     exploit this to disclose sensitive information.
    (CVE-2017-5610)

  - A SQL injection (SQLi) vulnerability exists in the     class-wp-query.php script due to a failure to sanitize     input to post type names. An unauthenticated, remote     attacker can exploit this to inject or manipulate SQL     queries in the back-end database, resulting in the     disclosure or manipulation of arbitrary data.
    (CVE-2017-5611)

  - A cross-site scripting (XSS) vulnerability exists in the     class-wp-posts-list-table.php script due to improper     validation of input to the posts list table. An     unauthenticated, remote attacker can exploit this, via a     specially crafted request, to execute arbitrary script     code in a user's browser session. (CVE-2017-5612)

  - A privilege escalation vulnerability exists in the REST     API due to a failure to properly sanitize user-supplied     input to the 'id' parameter when editing or deleting     blog posts. An unauthenticated, remote attacker can     exploit this issue to run arbitrary PHP code, inject     content into blog posts, modify blog post attributes, or     delete blog posts. (CVE-2017-1001000)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Aaron D. Campbell reports :

WordPress versions 4.7.1 and earlier are affected by three security issues :

- The user interface for assigning taxonomy terms in Press This is shown to users who do not have permissions to use it.

- WP_Query is vulnerable to a SQL injection (SQLi) when passing unsafe data. WordPress core is not directly vulnerable to this issue, but we've added hardening to prevent plugins and themes from accidentally causing a vulnerability.

- A cross-site scripting (XSS) vulnerability was discovered in the posts list table.

- An unauthenticated privilege escalation vulnerability was discovered in a REST API endpoint.

ID	Name	Product	Family	Severity
98271	WordPress 3.7.x < 3.7.18 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98270	WordPress 3.8.x < 3.8.18 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98269	WordPress 3.9.x < 3.9.16 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98268	WordPress 4.0.x < 4.0.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98267	WordPress 4.1.x < 4.1.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98266	WordPress 4.2.x < 4.2.12 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98265	WordPress 4.3.x < 4.3.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98264	WordPress 4.4.x < 4.4.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98263	WordPress 4.5.x < 4.5.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98262	WordPress 4.6.x < 4.6.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98261	WordPress 4.7.x < 4.7.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
9950	WordPress < 4.7.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
96932	Debian DSA-3779-1 : wordpress - security update	Nessus	Debian Local Security Checks	critical
96930	Debian DLA-813-1 : wordpress security update	Nessus	Debian Local Security Checks	critical
96906	WordPress < 4.7.2 Multiple Vulnerabilities	Nessus	CGI abuses	critical
96850	FreeBSD : wordpress -- multiple vulnerabilities (14ea4458-e5cd-11e6-b56d-38d547003487)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2017-5612

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

critical

critical

critical

critical