漏洞描述
WordPress before 4.9.1 contains a cross-site scripting caused by not requiring unfiltered_html capability for uploading .js files in functions.php, letting remote attackers execute scripts via crafted files, exploit requires upload permissions.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
wordpress.orghttps://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/↗wpscan.comhttps://wpscan.com/vulnerability/0d2323bd-aecd-4d58-ba4b-597a43034f57↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2017-17092↗lists.debian.orghttps://lists.debian.org/debian-lts-announce/2017/12/msg00019.html↗wpvulndb.comhttps://wpvulndb.com/vulnerabilities/8966↗