Sucuri has shared details about one of the cross-site scripting (XSS) vulnerabilities patched last week in WordPress. The flaw can be highly useful to attackers if combined with a content injection bug that has been exploited in the wild.
WordPress 4.7.3, released on March 6, patches six vulnerabilities, including three XSS issues. One of them, a stored XSS tracked as CVE-2017-6817, was identified and reported by Sucuri researcher Marc Montpas.
Since exploitation requires at least contributor privileges, the vulnerability is considered low risk. However, the risk is higher on WordPress versions prior to 4.7.2, which addresses a critical content injection and privilege escalation flaw.
The stored XSS has been around for some time, even before version 4.7, while the content injection flaw affects versions 4.7 and 4.7.1. Version 4.7.x is running on roughly half of WordPress websites, and judging by the large number of sites affected by the content injection attacks, many of them are not updated automatically.