WordPress <= 4.6.1 Stored XSS Via Theme File

How it was found

Hello Team,

Description:-

Vulnerable code is located at /wp-admin/includes/class-theme-installer-skin.php

POC:- https://nextcloud.com/readme.html

{F151887}

FIX:- Upgrade wordpress to latest

Refer:-

https://wpvulndb.com/vulnerabilities/8718 https://www.mehmetince.net/low-severity-wordpress/

Attack Scenario:- 1 – Attacker uploads a theme as a zip file. 2 – Webmaster who just want to download a theme and then upload, takes a theme file. 3 – And upload it without verify content of zip file.

Regards, Santhosh