CVE-2015-5714
MEDIUM
6.1
CVSS 3.0
Description
Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.
Affected WordPress components
-
WordPress coreUp to and including 4.3.0
A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.
Affected products and versions
- n/a n/a — Versions not specified
- wordpress wordpress — Up to and including 4.3.0
References
- www.debian.org http://www.debian.org/security/2015/dsa-3375
- www.debian.org http://www.debian.org/security/2015/dsa-3383
- www.securityfocus.com http://www.securityfocus.com/bid/76745
- www.securitytracker.com http://www.securitytracker.com/id/1033979
- codex.wordpress.org https://codex.wordpress.org/Version_4.3.1 Patch
- github.com https://github.com/WordPress/WordPress/commit/f72b21af23da6b6d54208e5c1d65ececdaa109c8
- security-tracker.debian.org https://security-tracker.debian.org/tracker/CVE-2015-5714
- wordpress.org https://wordpress.org/news/2015/09/wordpress-4-3-1/ Patch, Vendor Advisory
- wpvulndb.com https://wpvulndb.com/vulnerabilities/8186
- nvd.nist.gov Official NVD record