CVE-2017-17093

wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.

We have discovered 501,939 live websites that are affected by CVE-2017-17093.

Run a Free Instant Scan



Affected Software

Product  WordPress
Category Content Management System
Vulnerable Domains501,939 live websites (6.21% of WordPress install base)
Vulnerable Versions
  • from 0 through 4.9.1
Vulnerable Versions Count922 versions ( 63% of all versions)



Details

  • Published - Dec 2, 2017
  • Updated - Aug 5, 2024

Website Distribution by Country

Number of websites using CVE-2017-17093
United States100,452 websites


Italy52,211 websites
Japan48,568 websites
Germany37,885 websites
Russia27,834 websites
France24,231 websites
GB18,965 websites
Netherlands14,362 websites
Poland11,753 websites
Spain10,772 websites

Website Distribution by TLD

Number of websites using CVE-2017-17093
.com188,249 websites
.it34,904 websites
.ru23,201 websites
.de19,655 websites
.org18,739 websites
.net16,736 websites
.nl11,447 websites
.jp11,434 websites
.co.uk11,100 websites
.fr9,640 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2017-17093

Top websites that are affected by CVE-2017-17093. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****.br Brazil***
*******.com United States*,***
*****.com United States*,***
************.org United States*,***
*****.****.br Brazil*,***
*******.org United States*,***
********.****.br Brazil*,***
*********.io Netherlands*,***
***********.com United States*,***
*******.com United States*,***
See full domain list

FAQ

A total of 501,939 websites have been identified as vulnerable to CVE-2017-17093, based on global website indexing conducted by WebTechSurvey.
The WordPress is affected by the CVE-2017-17093 vulnerability.
WordPress versions up to and including 4.9.1 are vulnerable to CVE-2017-17093.