CVE-2015-3440 WordPress Core < 4.2.1 - Cross-Site Scripting via Comments
MediumCVSS 4.3
EPSS 16.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/wordpress(Debian:12) | < 4.2.1+dfsg-1 | 4.2.1+dfsg-1 |
| debian/wordpress(Debian:13) | < 4.2.1+dfsg-1 | 4.2.1+dfsg-1 |
| debian/wordpress(Debian:14) | < 4.2.1+dfsg-1 | 4.2.1+dfsg-1 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| WordPress | <= 4.2 | No fix listed |
| WordPress(WordPress) | >= 4.0, < 4.0.4 | 4.0.4 |
| WordPress(WordPress) | >= 4.1, < 4.1.4 | 4.1.4 |
| WordPress(WordPress) | = 4.2 | No fix listed |
References
- Debian Security Tracker CVE-2015-3440 vendor-advisory
- codex.wordpress.org
- FEDORA-2015-6778 vendor-advisory
- FEDORA-2015-6808 vendor-advisory
- FEDORA-2015-6790 vendor-advisory
- 121320 vdb-entry
- packetstormsecurity.com exploit
- 20150426 WordPress 4.2 stored XSS exploit mailing-list
- DSA-3250 vendor-advisory
- 74334 vdb-entry
- 1032199 vdb-entry
- core.trac.wordpress.org
- klikki.fi exploit
- wordpress.org patch vendor-advisory
- wpvulndb.com
- 36844 exploit
- Wordfence Intelligence third-party-advisory
- www.cve.org
- bugs.debian.org issue-tracking