CVE:CVE-2017-2171
CNNVD:CNNVD-201705-773
WordPress是WordPress软件基金会的一套使用PHP语言开发的博客平台，该平台支持在PHP和MySQL的服务器上架设个人博客网站。Captcha等都是使用在其中的插件。其中Captcha是一个网站后台验证码插件；Car Rental是一个汽车预定插件。
多款WordPress插件中存在跨站脚本漏洞。远程攻击者可利用该漏洞注入任意的Web脚本或HTML。以下产品和版本受到影响：WordPress Captcha 4.3.0之前的版本；Car Rental 1.0.5之前的版本；Contact Form Multi 1.2.1之前的版本；Contact Form 4.0.6之前的版本；Contact Form to DB 1.5.7之前的版本；Custom Admin Page 0.1.2之前的版本；Custom Fields Search 1.3.2之前的版本；Custom Search 1.36之前的版本；Donate 2.1.1之前的版本；Email Queue 1.1.2之前的版本；Error Log Viewer 1.0.6之前的版本；Facebook Button 2.54之前的版本；Featured Posts 1.0.1之前的版本；Gallery Categories 1.0.9之前的版本；Gallery 4.5.0之前的版本；Google +1 1.3.4之前的版本；Google AdSense 1.44之前的版本；Google Analytics 1.7.1之前的版本；Google Captcha (reCAPTCHA) 1.28之前的版本；Google Maps 1.3.6之前的版本；Google Shortlink 1.5.3之前的版本；Google Sitemap 3.0.8之前的版本；Htaccess 1.7.6之前的版本；Job Board 1.1.3之前的版本；Latest Posts 0.3之前的版本；Limit Attempts 1.1.8之前的版本；LinkedIn 1.0.5之前的版本；Multilanguage 1.2.2之前的版本；PDF&amp;amp;Print 1.9.4之前的版本；Pagination 1.0.7之前的版本；Pinterest 1.0.5之前的版本；Popular Posts 1.0.5之前的版本；Portfolio 2.4之前的版本；Post to CSV 1.3.1之前的版本；Profile Extra 1.0.7之前的版本；PromoBar 1.1.1之前的版本；Quotes and Tips 1.32之前的版本；Re-attacher 1.0.9之前的版本；Realty 1.1.0之前的版本；Relevant - Related Posts 1.2.0之前的版本；Sender 1.2.1之前的版本；SMTP 1.1.0之前的版本；Social Buttons Pack 1.1.1之前的版本；Subscriber 1.3.5之前的版本；Testimonials 0.1.9之前的版本；Timesheet 0.1.5之前的版本；Twitter Button 2.55之前的版本；User Role 1.5.6之前的版本；Updater 1.35之前的版本；Visitors Online 1.0.0之前的版本；Zendesk Help Center 1.0.5之前的版本。
solution:Upgrade bestwebsoft captcha to a higher version than 4.2.9,and avoid the version (,4.2.9]; Upgrade bestwebsoft car_rental to a higher version than 1.0.4,and avoid the version (,1.0.4]; Upgrade bestwebsoft contact_form to a higher version than 4.0.5,and avoid the version (,4.0.5]; Upgrade bestwebsoft contact_form_multi to a higher version than 1.2.0,and avoid the version (,1.2.0]; Upgrade bestwebsoft contact_form_to_db to a higher version than 1.5.6,and avoid the version (,1.5.6]; Upgrade bestwebsoft custom_admin_page to a higher version than 0.1.1,and avoid the version (,0.1.1]; Upgrade bestwebsoft custom_fields_search to a higher version than 1.3.1,and avoid the version (,1.3.1]; Upgrade bestwebsoft custom_search to a higher version than 1.35,and avoid the version (,1.35]; Upgrade bestwebsoft donate to a higher version than 2.1.0,and avoid the version (,2.1.0]; Upgrade bestwebsoft email_queue to a higher version than 1.1.1,and avoid the version (,1.1.1]; Upgrade bestwebsoft error_log_viewer to a higher version than 1.0.5,and avoid the version (,1.0.5]; Upgrade bestwebsoft facebook_button to a higher version than 2.53,and avoid the version (,2.53]; Upgrade bestwebsoft featured_posts to a higher version than 1.0.0,and avoid the version (,1.0.0]; Upgrade bestwebsoft gallery to a higher version than 4.4.9,and avoid the version (,4.4.9]; Upgrade bestwebsoft gallery_categories to a higher version than 1.0.8,and avoid the version (,1.0.8]; Upgrade bestwebsoft google_+1 to a higher version than 1.3.3,and avoid the version (,1.3.3]; Upgrade bestwebsoft google_adsense to a higher version than 1.43,and avoid the version (,1.43]; Upgrade bestwebsoft google_analytics to a higher version than 1.7.0,and avoid the version (,1.7.0]; Upgrade bestwebsoft google_captcha_(recaptcha) to a higher version than 1.27,and avoid the version (,1.27]; Upgrade bestwebsoft google_maps to a higher version than 1.3.5,and avoid the version (,1.3.5]; Upgrade bestwebsoft google_shortlink to a higher version than 1.5.2,and avoid the version (,1.5.2]; Upgrade bestwebsoft google_sitemap to a higher version than 3.0.7,and avoid the version (,3.0.7]; Upgrade bestwebsoft htaccess to a higher version than 1.7.5,and avoid the version (,1.7.5]; Upgrade bestwebsoft job_board to a higher version than 1.1.2,and avoid the version (,1.1.2]; Upgrade bestwebsoft latest_posts to a higher version than 0.2,and avoid the version (,0.2]; Upgrade bestwebsoft limit_attempts to a higher version than 1.1.7,and avoid the version (,1.1.7]; Upgrade bestwebsoft linkedin to a higher version than 1.0.4,and avoid the version (,1.0.4]; Upgrade bestwebsoft multilanguage to a higher version than 1.2.1,and avoid the version (,1.2.1]; Upgrade bestwebsoft pagination to a higher version than 1.0.6,and avoid the version (,1.0.6]; Upgrade bestwebsoft pdf_&_print to a higher version than 1.9.3,and avoid the version (,1.9.3]; Upgrade bestwebsoft pinterest to a higher version than 1.0.4,and avoid the version (,1.0.4]; Upgrade bestwebsoft popular_posts to a higher version than 1.0.4,and avoid the version (,1.0.4]; Upgrade bestwebsoft portfolio to a higher version than 2.3,and avoid the version (,2.3]; Upgrade bestwebsoft post_to_csv to a higher version than 1.3.0,and avoid the version (,1.3.0]; Upgrade bestwebsoft profile_extra to a higher version than 1.0.6,and avoid the version (,1.0.6]; Upgrade bestwebsoft promobar to a higher version than 1.1.0,and avoid the version (,1.1.0]; Upgrade bestwebsoft quotes_and_tips to a higher version than 1.31,and avoid the version (,1.31]; Upgrade bestwebsoft re-attacher to a higher version than 1.0.8,and avoid the version (,1.0.8]; Upgrade bestwebsoft realty to a higher version than 1.0.9,and avoid the version (,1.0.9]; Upgrade bestwebsoft relevant_-_related_posts to a higher version than 1.1.9,and avoid the version (,1.1.9]; Upgrade bestwebsoft sender to a higher version than 1.2.0,and avoid the version (,1.2.0]; Upgrade bestwebsoft smtp to a higher version than 1.0.9,and avoid the version (,1.0.9]; Upgrade bestwebsoft social_buttons_pack to a higher version than 1.1.0,and avoid the version (,1.1.0]; Upgrade bestwebsoft subscriber to a higher version than 1.3.4,and avoid the version (,1.3.4]; Upgrade bestwebsoft testimonials to a higher version than 0.1.8,and avoid the version (,0.1.8]; Upgrade bestwebsoft timesheet to a higher version than 0.1.4,and avoid the version (,0.1.4]; Upgrade bestwebsoft twitter_button to a higher version than 2.54,and avoid the version (,2.54]; Upgrade bestwebsoft updater to a higher version than 1.34,and avoid the version (,1.34]; Upgrade bestwebsoft user_role to a higher version than 1.5.5,and avoid the version (,1.5.5]; Upgrade bestwebsoft visitors_online to a higher version than 0.9,and avoid the version (,0.9]; Upgrade bestwebsoft zendesk_help_center to a higher version than 1.0.4,and avoid the version (,1.0.4]