Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5.4
CVSSv3

CVE-2017-6814

Published: 12/03/2017 Updated: 19/03/2019
CVSS v2 Base Score: 3.5 | Impact Score: 2.9 | Exploitability Score: 6.8
CVSS v3 Base Score: 5.4 | Impact Score: 2.7 | Exploitability Score: 2.3
VMScore: 316
Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Subscribe to Wordpress

Vulnerability Summary

In WordPress prior to 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp-includes/js/mediaelement/wp-playlist.js.

Vulnerable Product Search on Vulmon Subscribe to Product

wordpress wordpress

debian debian linux 8.0

debian debian linux 9.0

Vendor Advisories

Debian CVElist Bug Report Logs: wordpress: 4.7.3 security release
Debian Bug report logs - #857026 wordpress: 473 security release Package: src:wordpress; Maintainer for src:wordpress is Craig Small <csmall@debianorg>; Reported by: Craig Small <csmall@debianorg> Date: Tue, 7 Mar 2017 10:33:02 UTC Severity: grave Tags: security, upstream Found in version wordpress/472 Fixed ...
Debian Security Advisories: DSA-3815-1 wordpress -- security update
Several vulnerabilities were discovered in wordpress, a web blogging tool They would allow remote attackers to delete unintended files, mount Cross-Site Scripting attacks, or bypass redirect URL validation mechanisms For the stable distribution (jessie), these problems have been fixed in version 41+dfsg-1+deb8u13 For the upcoming stable (stretc ...
Arch Linux Issues:
An authenticated cross-site scripting (XSS) vulnerability has been discovered in WordPress before 473 via Media File Metadata This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/mediaphp and (2) mishandling of meta information in the renderTracks function in wp-includes/js/ ...

Github Repositories

https://github.com/vkril/Cybersecurity-Week-7-Project-WordPress-vs.-Kali

Cybersecurity-Week-7-Project-WordPress-vs-Kali Project 7 - WordPress Pentesting Time spent: 45 hours spent in total Objective: Find, analyze, recreate, and document five vulnerabilities affecting an old version of WordPress Pentesting Report Authenticated Stored Cross-Site Scripting (XSS) ID: CVE-2015-5622 Summary: Vulnerability types: XSS Tested in version: 42 Fixed

https://github.com/Sticksword/wp-kali-week7

Stored XSS in Wordpress Core for embed youtube urls: created by adding crafted xss youtube embed url WPScan summary: Title: WordPress 40-472 - Authenticated Stored Cross-Site Scripting (XSS) in YouTube URL Embeds Reference: wpvulndbcom/vulnerabilities/8768 Reference: wordpressorg/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/ Reference: ht

https://github.com/PatyRey/Codepath-Week-7-8

Project 7 - WordPress Pentesting Time spent: 12 hours spent in total Objective: Find, analyze, recreate, and document Three vulnerabilities affecting an old version of WordPress Pentesting Report 1 Authenticated XSS in comments (CVE-2019-9787) Summary: Wordpress did not properly filter comments, leading to remote code execution by unauthenticated user configuration Vulne

https://github.com/ftruncale/Codepath-Week-7

Project 7 - WordPress Pentesting Time spent: 4 hours spent in total Objective: Find, analyze, recreate, and document five vulnerabilities affecting an old version of WordPress Pentesting Report Authenticated Stored Cross-Site Scripting (XSS) in YouTube URL Embeds (CVE-2017-6817) Summary: Vulnerability types: XSS Tested in version: 42 Fixed in version: 4213 GIF Walk

https://github.com/zmh68/codepath-w07

codepath week 7 assignment

Project 7 - WordPress Pentesting Time spent: 5 hours spent in total Objective: Find, analyze, recreate, and document five vulnerabilities affecting an old version of WordPress Pentesting Report (Required) CVE-2015-3440 - Unauthenticated Stored Cross-Site Scripting Summary: Vulnerability types: XSS Tested in version: 42 Fixed in version: 421 GIF Walkthrough:

https://github.com/thumb2267/WordPress_Pentesting

Project 7 - WordPress Pentesting Time spent: 5 hours spent in total Objective: Find, analyze, recreate, and document five vulnerabilities affecting an old version of WordPress Pentesting Report (Required) Unauthenticated Stored Cross-Site Scripting(CVE-2015-3440) Summary: Vulnerability types: XSS Tested in version: 42 Fixed in version: 421 GIF Walkthrough:

https://github.com/hungie1122/cybersec_kali_vs_old_wp_p7

Hung_Nguyen_Cybersecurity_University Project 7 - WordPress Pentesting Time spent: 6 hours spent in total Objective: Find, analyze, recreate, and document three (required) to five (optional) vulnerabilities affecting an old version of WordPress Pentesting Report (Required) 40-472 - Authenticated Stored Cross-Site Scripting (XSS) in YouTube URL Embeds Summary: Vulnerabi

https://github.com/HarryMartin001/WordPress-vs.-Kali-Week-7-8

Project 7 - WordPress Pen Testing Time spent: 12 hours spent in total Objective: Find, analyze, recreate, and document five vulnerabilities affecting an old version of WordPress Pen Testing Report 1 Authenticated Stored Cross-Site Scripting (XSS) ID: CVE-2015-5622 Summary: Vulnerability types:XSS Tested in version:42 Fixed in version:423 GIF Walkthrough:

https://github.com/CamHoo/WordPress-Pen-Testing-Lab

WordPress-Pen-Testing-Lab Exploit 1 WordPress 360-472 - Authenticated Cross-Site Scripting (XSS) via Media File Metadata (CVE-2017-6814) Reference: sumofpwnnl/advisory/2016/wordpress_audio_playlist_functionality_is_affected_by_cross_site_scriptinghtml To exploit this vulnerability, I used the following steps: Download an arbitrary MP3 file (I prefer something by

https://github.com/Gshack18/WPS_Scan

My WPS scan Results

Project 7 - WordPress Pentesting Pentesting Report Time spent: 9 hours spent in total because I couldn't get it up and running in Vbox Objective: Find, analyze, recreate, and document six vulnerabilities affecting an old version of WordPress Table of Contents List of Vulnerabilities found -[!] Title: WordPress 42-472 - Press This CSRF DoS -[!] Title: WordPress 23-4

https://github.com/mattdegroff/CodePath_Wk7

Project 7 - WordPress Pentesting Time spent: 3 hours spent in total Objective: Find, analyze, recreate, and document three vulnerabilities affecting an old version of WordPress Authenticated Stored Cross-Site Scripting - CVE-2015-5622 Summary: Cross-site scripting (XSS) vulnerability in WordPress before 423 allows remote authenticated users to inject arbitrary web script

https://github.com/zyeri/wordpress-pentesting

Project 7 - WordPress Pentesting (CSE 4253)

Project 7 - WordPress Pentesting Time spent: 3 hours spent in total Objective: Find, analyze, recreate, and document five vulnerabilities affecting an old version of WordPress Pentesting Report CVE-2016-7168 Summary: Vulnerability types: XSS Tested in version: 42 Fixed in version: 461 Steps to recreate: Create an image with a name containing something like <

https://github.com/Gshack18/IST_590_fall

My WPS scan Results

Project 7 - WordPress Pentesting Pentesting Report Time spent: 9 hours spent in total because I couldn't get it up and running in Vbox Objective: Find, analyze, recreate, and document six vulnerabilities affecting an old version of WordPress Table of Contents List of Vulnerabilities found -[!] Title: WordPress 42-472 - Press This CSRF DoS -[!] Title: WordPress 23-4

https://github.com/PatyRey/Codepath-WordPress-Pentesting

Project 7 - WordPress Pentesting Time spent: 12 hours spent in total Objective: Find, analyze, recreate, and document Three vulnerabilities affecting an old version of WordPress Pentesting Report 1 Authenticated XSS in comments (CVE-2019-9787) Summary: Wordpress did not properly filter comments, leading to remote code execution by unauthenticated user configuration Vulne

References

CWE-79https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/https://sumofpwn.nl/advisory/2016/wordpress_audio_playlist_functionality_is_affected_by_cross_site_scripting.htmlhttps://github.com/WordPress/WordPress/commit/28f838ca3ee205b6f39cd2bf23eb4e5f52796bd7https://codex.wordpress.org/Version_4.7.3http://openwall.com/lists/oss-security/2017/03/06/8http://www.securityfocus.com/bid/96601https://wpvulndb.com/vulnerabilities/8765http://www.securitytracker.com/id/1037959http://www.debian.org/security/2017/dsa-3815https://nvd.nist.govhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=857026https://github.com/zmh68/codepath-w07https://www.debian.org/security/./dsa-3815
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
deserializationCVE-2024-4040cross-site scriptingCVE-2023-25790CVE-2024-2961XML external entityCVE-2024-26926CVE-2024-32806CVE-2024-32711
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook