PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5490 Wordpress CVE debrief

CVE-2017-5490 is a cross-site scripting (XSS) issue in WordPress versions before 4.7.1. The vulnerable path involves theme-name fallback handling in wp-includes/class-wp-theme.php, with related admin-side theme installer logic noted in wp-admin/includes/class-theme-installer-skin.php. A crafted theme directory name could be rendered into web output and allow arbitrary script or HTML injection. The NVD record classifies the issue as medium severity and links it to CWE-79.

Vendor
Wordpress
Product
Unknown
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-15
Original CVE updated
2026-05-13
Advisory published
2017-01-15
Advisory updated
2026-05-13

Who should care

WordPress site operators, administrators, managed hosting providers, and security teams responsible for theme installation and admin interface exposure should care, especially if any systems were running WordPress 4.7 or earlier.

Technical summary

The supplied NVD data describes a CWE-79 XSS weakness in WordPress theme-name fallback logic. The CVSS v3.0 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network reachability, low attack complexity, no privileges required, and user interaction needed. Impact is limited to confidentiality and integrity, with scope changed. WordPress 4.7.1 release notes and the linked patch commit indicate the issue was addressed in that release line.

Defensive priority

Medium. The flaw is publicly documented and fixed in WordPress 4.7.1, but the supplied data does not indicate known active exploitation or KEV listing.

Recommended defensive actions

  • Upgrade WordPress to 4.7.1 or later immediately if any affected version is still in use.
  • Review any workflows that install or display themes, especially where theme directory names may come from untrusted sources.
  • Confirm the patch referenced by the WordPress commit and 4.7.1 release notes is present in your deployed codebase.
  • Limit administrative access to trusted users and keep browser-based admin sessions protected with strong authentication and session hygiene.
  • Audit theme packages and custom deployments for unusual directory names or other content that could be rendered in admin interfaces.

Evidence notes

This debrief is based only on the supplied NVD record and linked official/vendor references. The core facts come from the NVD description, CVSS vector, CWE-79 classification, and affected version range ending at WordPress 4.7. The WordPress 4.7.1 release notes and linked GitHub patch commit support that the issue was corrected in 4.7.1. No exploitation or KEV designation is asserted because none is present in the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5490 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5490

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5490 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5490

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.