Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
CVE-2016-7168: WordPress admin can be forced to run malicious code
CVE-2016-7168 · published 9 years ago
Summary
In versions of WordPress earlier than 4.6.1, an attacker could give an administrator a specially named image file to upload. When the file is uploaded, the hidden script in the filename can run in the admin’s browser, potentially stealing data or changing settings. Upgrade WordPress to 4.6.1 or later, or apply the available patch, to stop this risk.
What to do
- Update debian wordpress to version 4.6.1+dfsg-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | wordpress |
< 4.6.1+dfsg-1 Fix: upgrade to 4.6.1+dfsg-1
|
| Debian:13 | debian | wordpress |
< 4.6.1+dfsg-1 Fix: upgrade to 4.6.1+dfsg-1
|
| Debian:14 | debian | wordpress |
< 4.6.1+dfsg-1 Fix: upgrade to 4.6.1+dfsg-1
|
| – | wordpress | wordpress |
<= 4.6 cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
Original advisory text
Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or ...
Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename.
References
- https://security-tracker.debian.org/tracker/CVE-2016-7168 Vendor Advisory
- http://www.debian.org/security/2016/dsa-3681
- http://www.openwall.com/lists/oss-security/2016/09/08/19 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/09/08/24 Third Party Advisory
- http://www.securityfocus.com/bid/92841 Third Party Advisory VDB Entry
- https://codex.wordpress.org/Version_4.6.1 Patch
- https://github.com/WordPress/WordPress/commit/c9e60dab176635d4bfaaf431c0ea891e47... Patch
- https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_vulnerability_... Third Party Advisory
- https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-rele... Patch Vendor Advisory
- https://wpvulndb.com/vulnerabilities/8615
Severity
4.8
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published5 Jan 2017
Updated30 Oct 2026
First seen22 Sep 2026
Track software like this
Free during beta