CVE-2017-17092

Description

wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	wordpress	4.9.1+dfsg-1	—
Debian 13	wordpress	4.9.1+dfsg-1	—
Debian 12	wordpress	4.9.1+dfsg-1	—
Debian 9	wordpress	4.7.5+dfsg-2+deb9u2	DSA-4090-1
Debian 8	wordpress	4.1+dfsg-1+deb8u16	DSA-4090-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Debian 7	wordpress	3.6.1+dfsg-1~deb7u20	DLA-1216-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	wordpress	No fix yet	—

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

WordPress < 4.9.1 - Authenticated JavaScript File Upload http/cves/2017/CVE-2017-17092.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Advisories 2

DSA-4090-1 wordpress - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-1216-1 wordpress - security update Debian Security (DSA / DLA) · Mar 9, 2026

wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might al…