cve/2017/CVE-2017-5490.md

CVE-2017-5490

Description

Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php.

POC

Reference

• https://wpvulndb.com/vulnerabilities/8718

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/Afetter618/WordPress-PenTest
• https://github.com/sammanthp007/WordPress-Pentesting