WordPress 4.0.x < 4.0.16 Multiple Vulnerabilities

medium Web App Scanning Plugin ID 98279

Language:

Synopsis

Description

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities :

- A cross-site scripting (XSS) vulnerability exists in the wp_playlist_shortcode() function within the /wp-includes/media.php script due to a failure to validate input passed via audio file metadata before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-6814)

- A cross-site redirection vulnerability exists due to a failure to validate input passed via control characters before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted link, to redirect a user from an intended legitimate website to an arbitrary website of the attacker's choosing. (CVE-2017-6815)

- An unspecified flaw exists in the plugin deletion functionality that allows an authenticated, remote attacker to delete unintended files. (CVE-2017-6816)

- A cross-site scripting (XSS) vulnerability exists due to a failure to validate input to video URLs in YouTube embeds before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-6817)

- A cross-site scripting (XSS) vulnerability exists due to a failure to validate input to taxonomy term names before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-6818)

- A cross-site request forgery (XSRF) vulnerability exists in the Press This functionality, specifically within /wp-admin/press-this.php when handling HTTP requests, due to a failure to require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted link, to cause excessive consumption of server resources. (CVE-2017-6819)

- A DOM-based cross-site scripting (XSS) vulnerability exists in the renderTracks() function within the /wp-includes/js/mediaelement/wp-playlist.min.js script due to a failure to validate input passed via audio file metadata before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.