CVE-2017-6396: An issue was discovered in WPO-Foundation WebPageTest 3.0.

Security readout for executives and security teams

CVE-2017-6396 is a cross-site scripting issue in WPO-Foundation WebPageTest 3.0. If an organization exposes a vulnerable WebPageTest instance, attacker-controlled script could run in a user's browser under that site's trust context. Sources do not provide a CVSS score, confirmed patch version, or active exploitation evidence. Exposure is likely limited to organizations running WebPageTest 3.0, especially internet-facing or shared internal instances. The bundle does not identify managed services, downstream packages, or broader affected versions. Treat this as a targeted cleanup item, not an emergency, unless WebPageTest 3.0 is externally exposed or used by privileged staff. Prioritize inventory and access control first because patch details are incomplete in the supplied sources. Mitigation focus: Inventory WebPageTest deployments and identify any version 3.0 instances.; Review the WebPageTest GitHub issue and vendor guidance for patch direction.; Limit public access to affected instances until remediation is confirmed..

Prepared

Jun 13, 2026, 06:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.