CVE-2015-8834
MEDIUMWordPress < 4.2.2 - Cross-Site Scripting via Long Comment Storage
Title source: llmDescription
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440.
References (3)
Core 3
Core References
Patch, Vendor Advisory x_refsource_confirm
https://wordpress.org/news/2015/05/wordpress-4-2-2/
Patch x_refsource_confirm
https://codex.wordpress.org/Version_4.2.2
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2016/dsa-3639
Scores
CVSS v3
6.1
EPSS
0.0075
EPSS Percentile
73.3%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
wordpress/wordpress
< 4.2.1
Published
May 22, 2016
Tracked Since
Feb 18, 2026