CVE-2015-5714

MEDIUM

WordPress <4.3.1 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.

References (9)

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/76745

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1033979

[Patch] https://codex.wordpress.org/Version_4.3.1

[Patch, Vendor Advisory] https://wordpress.org/news/2015/09/wordpress-4-3-1/

[Third Party Advisory] https://wpvulndb.com/vulnerabilities/8186

[Patch] https://github.com/WordPress/WordPress/commit/f72b21af23da6b6d54208e5c1d65ececdaa109c8

View Patch ZIP pw:eip

[Third Party Advisory] http://www.debian.org/security/2015/dsa-3375

[Third Party Advisory] http://www.debian.org/security/2015/dsa-3383

[Third Party Advisory] https://security-tracker.debian.org/tracker/CVE-2015-5714

Scores

CVSS v3 6.1

EPSS 0.3065

EPSS Percentile 96.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-79

Status draft

Affected Products (1)

wordpress/wordpress < 4.3.0

Timeline

Published May 22, 2016

Tracked Since Feb 18, 2026