Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename.

See upstream announcement :

  - [WordPress 4.6.1 Security and Maintenance     Release](https://wordpress.org/news/2016/09/wordpress-4-     6-1-security-and-maintenance-release/)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in wordpress, a web blogging tool, which could allow remote attackers to compromise a site via cross-site scripting, cross-site request forgery, path traversal, or bypass restrictions.

Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following issues.

CVE-2015-8834: Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440

CVE-2016-4029: WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.

CVE-2016-5836: The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.

CVE-2016-6634: Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2016-6635: Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax- actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.

CVE-2016-7168: Fix a cross-site scripting vulnerability via image filename.

CVE-2016-7169: Fix a path traversal vulnerability in the upgrade package uploader.

For Debian 7 'Wheezy', these problems have been fixed in version 3.6.1+dfsg-1~deb7u12.

We recommend that you upgrade your wordpress packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

See upstream announcements :

  - [WordPress 4.6     &ldquo;Pepper&rdquo;](https://wordpress.org/news/2016/08     /pepper/)

  - [WordPress 4.6.1 Security and Maintenance     Release](https://wordpress.org/news/2016/09/wordpress-4-     6-1-security-and-maintenance-release/)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.6.1.
It is, therefore, affected by multiple vulnerabilities :

  - A cross-site scripting vulnerability (XSS) exists when     handling file names of uploaded images due to improper     validation of input before returning it to users. An     authenticated, remote attacker can exploit this, via a     specially crafted request, to execute arbitrary script     code in a user's browser session. (CVE-2016-7168)

  - A path traversal vulnerability exists in the WordPress     upgrade package uploader due to improper sanitization of     user-supplied input. An authenticated, remote attacker     can exploit this, via a specially crafted request, to     impact confidentiality, integrity, and availability.
    (CVE-2016-7169)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
94787	Fedora 25 : wordpress (2016-34403df2af)	Nessus	Fedora Local Security Checks	medium
93835	Debian DSA-3681-1 : wordpress - security update	Nessus	Debian Local Security Checks	high
93667	Debian DLA-633-1 : wordpress security update	Nessus	Debian Local Security Checks	high
93633	Fedora 24 : wordpress (2016-a8657278bf)	Nessus	Fedora Local Security Checks	high
93630	Fedora 23 : wordpress (2016-91bfe9ddb8)	Nessus	Fedora Local Security Checks	high
93516	WordPress < 4.6.1 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2016-7168

medium

Tenable Plugins

medium

high

high

high

high

medium