PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-6103 Anyvar Project CVE debrief

CVE-2017-6103 describes a persistent cross-site scripting (XSS) vulnerability in the AnyVar WordPress plugin version 0.1.1. NVD classifies it as CWE-79 with a CVSS v3.0 score of 6.1 (medium), indicating network-based exploitation that requires user interaction and can affect confidentiality and integrity through script execution in a victim’s browser. The record was published by NVD on 2017-03-02 and later updated on 2026-05-13; that later date reflects metadata maintenance, not the original disclosure date.

Vendor
Anyvar Project
Product
CVE-2017-6103
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-02
Original CVE updated
2026-05-13
Advisory published
2017-03-02
Advisory updated
2026-05-13

Who should care

WordPress site operators running AnyVar v0.1.1, security teams responsible for plugin inventory and web application hardening, and maintainers or integrators who rely on AnyVar in production sites.

Technical summary

NVD lists CVE-2017-6103 as a persistent XSS issue in anyvar_project:anyvar version 0.1.1 for WordPress. The official NVD record maps it to CWE-79 and assigns CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, which indicates remote exploitation without privileges but with user interaction required. Because the flaw is persistent, malicious script content can be stored and later rendered to other users, making it important to treat any affected content or plugin instance as potentially unsafe until verified.

Defensive priority

Medium

Recommended defensive actions

  • Identify whether AnyVar v0.1.1 is installed on any WordPress instance and remove or disable it if it is not actively needed.
  • Check official vendor or project sources for a fixed release or replacement before continuing to use the plugin.
  • Review pages, posts, and plugin-managed content for unexpected or malicious script-like input and clean affected records.
  • Apply standard browser-side and application-side hardening for XSS risk, including output sanitization and least-privilege admin access controls where you maintain the codebase.
  • Use the NVD and referenced advisories to track the issue status and confirm whether your deployed version is the vulnerable 0.1.1 release.

Evidence notes

The NVD record identifies the affected CPE as cpe:2.3:a:anyvar_project:anyvar:0.1.1:*:*:*:*:wordpress:*:* and lists CWE-79 as the weakness. The CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Referenced third-party advisories include SecurityFocus BID 96532 and VapiLabs advisory v=177. No exploit steps or patch details beyond the supplied corpus are included here.

Official resources

NVD published the CVE record on 2017-03-02T22:59:00.433Z. The record was modified on 2026-05-13T00:24:29.033Z, which should be treated as an update to the database entry rather than the original vulnerability disclosure date.