blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2015-7357

MEDIUM 6.1 CVSS 3.0
Published
October 3, 2017
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-79
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #<svg onload=alert(1)>.

Affected products and versions

  • n/a n/a — Versions not specified
  • udesign_project udesign — Version 2.3.0
  • udesign_project udesign — Version 2.3.1
  • udesign_project udesign — Version 2.4.0
  • udesign_project udesign — Version 2.4.1
  • udesign_project udesign — Version 2.4.2
  • udesign_project udesign — Version 2.4.3
  • udesign_project udesign — Version 2.4.4
  • udesign_project udesign — Version 2.4.5
  • udesign_project udesign — Version 2.4.6
  • udesign_project udesign — Version 2.4.7
  • udesign_project udesign — Version 2.4.8
  • udesign_project udesign — Version 2.4.9
  • udesign_project udesign — Version 2.4.10
  • udesign_project udesign — Version 2.4.11
  • udesign_project udesign — Version 2.4.12
  • udesign_project udesign — Version 2.4.13
  • udesign_project udesign — Version 2.4.14
  • udesign_project udesign — Version 2.4.15
  • udesign_project udesign — Version 2.4.16
  • udesign_project udesign — Version 2.4.17
  • udesign_project udesign — Version 2.4.18
  • udesign_project udesign — Version 2.4.19
  • udesign_project udesign — Version 2.5.0
  • udesign_project udesign — Version 2.5.1
  • udesign_project udesign — Version 2.5.2
  • udesign_project udesign — Version 2.5.3
  • udesign_project udesign — Version 2.5.4
  • udesign_project udesign — Version 2.5.5
  • udesign_project udesign — Version 2.5.6
  • udesign_project udesign — Version 2.6.0
  • udesign_project udesign — Version 2.7.0
  • udesign_project udesign — Version 2.7.1
  • udesign_project udesign — Version 2.7.2
  • udesign_project udesign — Version 2.7.3
  • udesign_project udesign — Version 2.7.4
  • udesign_project udesign — Version 2.7.5
  • udesign_project udesign — Version 2.7.6
  • udesign_project udesign — Version 2.7.7
  • udesign_project udesign — Version 2.7.8
  • udesign_project udesign — Version 2.7.9

References

  • packetstormsecurity.com http://packetstormsecurity.com/files/133867/WordPress-U-Design-Theme-2.7.9-Cross-Site-Scripting.html Third Party Advisory, VDB Entry
  • seclists.org http://seclists.org/fulldisclosure/2015/Oct/25 Mailing List, Third Party Advisory
  • themeforest.net http://themeforest.net/item/udesign-responsive-wordpress-theme/253220 Third Party Advisory
  • wpvulndb.com https://wpvulndb.com/vulnerabilities/8177 Third Party Advisory
  • nvd.nist.gov Official NVD record