CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2015-5622 – WordPress Core < 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
https://notcve.org/view.php?id=CVE-2015-5622
Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php. Vulnerabilidad de XSS en WordPress en versiones anteriores a 4.2.3, permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través del aprovechamiento del rol de Author o Contributor para colocar un código corto manipulado dentro de un elemento HTML, relacionado con wp-includes/kses.php y wp-includes/shortcodes.php. • http://codex.wordpress.org/Version_4.2.3 http://openwall.com/lists/oss-security/2015/07/23/18 http://www.debian.org/security/2015/dsa-3328 http://www.debian.org/security/2015/dsa-3332 http://www.debian.org/security/2015/dsa-3383 http://www.securityfocus.com/bid/76011 http://www.securitytracker.com/id/1033037 https://core.trac.wordpress.org/changeset/33359 https://klikki.fi/adv/wordpress3.html https://wordpress.org/news/2015/07/wordpress-4-2-3 https:/& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8834 – WordPress Core < 4.2.2 - Cross-Site Scripting via Comments
https://notcve.org/view.php?id=CVE-2015-8834
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440. Vulnerabilidad de XSS en wp-includes/wp-db.php en WordPress en versiones anteriores a 4.2.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de un comentario largo que se almacena de manera incorrecta debido a las limitaciones en el tipo de dato MySQL TEXT. NOTA: esta vulnerabilidad existe debido a una solución incompleta de CVE-2015-3440. • http://www.debian.org/security/2016/dsa-3639 https://codex.wordpress.org/Version_4.2.2 https://wordpress.org/news/2015/05/wordpress-4-2-2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 64%CPEs: 3EXPL: 4CVE-2015-3440 – WordPress Core < 4.2.1 - Cross-Site Scripting via Comments
https://notcve.org/view.php?id=CVE-2015-3440
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. Vulnerabilidad de XSS en wp-includes/wp-db.php en WordPress en versiones anteriores a 4.2.1, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de un comentario largo que es almacenado indebidamente a causa de las limitaciones en el tipo de datos de MySQL TEXT. • https://www.exploit-db.com/exploits/36844 http://codex.wordpress.org/Version_4.2.1 http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html http://osvdb.org/show/osvdb/121320 http://packetstormsecurity.com/files/131644/WordPress-4.2-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2015/Apr/84 http:/&# • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 1CVE-2015-3438 – WordPress Core < 4.1.2 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-3438
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment. Múltiples vulnerabilidades de XSS en WordPress en versiones anteriores a 4.1.2 cuando se utiliza MySQL sin modo estricto, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de un (1) carácter UTF-8 de cuatro bytes o (2) carácter no válido que alcanza la capa de la base de datos, según lo demostrado mediante un carácter manipulado en un comentario. • http://codex.wordpress.org/Version_4.1.2 http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html http://www.debian.org/security/2015/dsa-3250 http://www.securityfocus.com/bid/74269 http://www.securitytracker.com/id/1032207 https://cedricvb.be/post/wordpress-stored-xss-vulnerability-4-1-2 https://wordpress.org& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 10EXPL: 3CVE-2015-3439 – WordPress Core < 4.1.2 - Cross-Site Scripting via Ephox in Plupload
https://notcve.org/view.php?id=CVE-2015-3439
Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as. Vulnerabilidad de XSS en el shim Ephox (anteriormente Moxiecode) plupload.flash.swf 2.1.2 en Plupload, tal como se utiliza en WordPress 3.9.x, 4.0.x y 4.1.x en versiones anteriores a 4.1.2 y otros productos, permite a atacantes remotos ejecutar funciones JavaScript del mismo origen a través del parámetro target, según lo demostrado ejecutando cierta función de clic, relacionada con _init.as y _fireEvents.as. • http://codex.wordpress.org/Version_4.1.2 http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html http://www.debian.org/security/2015/dsa-3250 http://www.securityfocus.com/bid/74269 http://www.securitytracker.com/id/1032207 http://zoczus.blogspot.com/2015/04/plupload-same-origin-method-execution.html https://c • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •