CVE-2017-5488: XSS
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpressto a version that resolves this vulnerability.Fixed in 4.7.1 - Compensating control
Restrict access to the WordPress wp-admin/update-core.php endpoint so only trusted administrators can reach it (e.g., via network controls/ACL/firewall), reducing exposure to remote attackers.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5488?
CVE-2017-5488 is classified as a high severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2017-5488?
To fix CVE-2017-5488, upgrade your WordPress installation to version 4.7.1 or later.
What are the potential impacts of CVE-2017-5488?
The potential impacts of CVE-2017-5488 include unauthorized execution of scripts or HTML, compromising user data and website integrity.
Who is affected by CVE-2017-5488?
CVE-2017-5488 affects all WordPress installations prior to version 4.7.1.
How does CVE-2017-5488 enable cross-site scripting?
CVE-2017-5488 enables cross-site scripting by allowing attackers to inject arbitrary scripts through manipulated plugin headers.