CVE-2017-5612

Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt.

• CWE-79

• http://www.debian.org/security/2017/dsa-3779Third Party Advisory
• http://www.openwall.com/lists/oss-security/2017/01/28/5Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/95816Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037731Third Party Advisory, VDB Entry
• https://codex.wordpress.org/Version_4.7.2Release Notes
• https://github.com/WordPress/WordPress/commit/4482f9207027de8f36630737ae085110896ea849Issue Tracking, Patch
• https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/Patch, Vendor Advisory
• https://wpvulndb.com/vulnerabilities/8731Third Party Advisory
• http://www.debian.org/security/2017/dsa-3779Third Party Advisory
• http://www.openwall.com/lists/oss-security/2017/01/28/5Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/95816Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037731Third Party Advisory, VDB Entry
• https://codex.wordpress.org/Version_4.7.2Release Notes
• https://github.com/WordPress/WordPress/commit/4482f9207027de8f36630737ae085110896ea849Issue Tracking, Patch
• https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/Patch, Vendor Advisory
• https://wpvulndb.com/vulnerabilities/8731Third Party Advisory

Published

Jan 30, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5606An incorrect implementation of "XEP-0280: Message Carbons" i…5.9
• CVE-2017-5607Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, …
• CVE-2017-5608Cross-site scripting (XSS) vulnerability in the image upload…
• CVE-2017-5609SQL injection vulnerability in include/functions_entries.inc…
• CVE-2017-5610wp-admin/includes/class-wp-press-this.php in Press This in W…
• CVE-2017-5611SQL injection vulnerability in wp-includes/class-wp-query.ph…9.8
• CVE-2017-5613Format string vulnerability in cgiemail and cgiecho allows r…
• CVE-2017-5614Open redirect vulnerability in cgiemail and cgiecho allows r…6.1
• CVE-2017-5615cgiemail and cgiecho allow remote attackers to inject HTTP h…
• CVE-2017-5616Cross-site scripting (XSS) vulnerability in cgiemail and cgi…
• CVE-2017-5617The SVG Salamander (aka svgSalamander) library, when used in…7.4
• CVE-2017-5618GNU screen before 4.5.1 allows local users to modify arbitra…