CVE-2017-17093

Description

wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.

Weakness classification

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references

• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Patch, Release Notes, Vendor Advisory
• cve@mitre.org — Patch, Third Party Advisory
• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org — Release Notes, Vendor Advisory
• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Release Notes, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory