CVE-2015-3429
Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in...
Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
- Record
CVE-2015-3429- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
- Record
CVE-2015-3429- Updated
- 2026-11-02
EUVDEUVD-2015-3473 No score
Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
- Record
EUVD-2015-3473- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-44qg-j3rp-67rc No score
Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in...
Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
- Record
GHSA-44qg-j3rp-67rc- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
- Record
CVE-2015-3429- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-3429 No score
Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
- Record
DEBIAN-CVE-2015-3429- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-3429 No score
Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
- Record
UBUNTU-CVE-2015-3429- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wordpressDebian:12 |
before 4.2.2+dfsg-1 | 4.2.2+dfsg-1 |
wordpressDebian:13 |
before 4.2.2+dfsg-1 | 4.2.2+dfsg-1 |
wordpressDebian:14 |
before 4.2.2+dfsg-1 | 4.2.2+dfsg-1 |
wordpressDebian:8 From an advisory covering 2 CVEs |
before 4.1+dfsg-1+deb8u2, plus listed versions 4.1+dfsg-14.1+dfsg-1+deb8u1 |
4.1+dfsg-1+deb8u2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-3429 is a medium vulnerability (CVSS 4.3) in Automattic Genericons, published June 17, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.91%, the 90th percentile. Fixed in wordpress 4.2.2+dfsg-1.
References
digitalocean.com/community/tutorials/how-to-protect-your-wordpress-site-from-the-genericons-example-html-xss-vulnerability
wpvulndb.com/vulnerabilities/7965
securityfocus.com/archive/1/535486/100/1000/threaded
debian.org/security/2015/dsa-3328
lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html
github.com/Automattic/Genericons/commit/798ac98579dd72dfdb11bdee3e7bebf01cffb1f7
Show 11 moreShow less
wordpress.org/news/2015/05/wordpress-4-2-2
netsparker.com/cve-2015-3429-dom-xss-vulnerability-in-twenty-fifteen-wordpress-theme
seclists.org/fulldisclosure/2015/May/41
packetstormsecurity.com/files/131802/WordPress-Twenty-Fifteen-4.2.1-Cross-Site-Scripting.html
nvd.nist.gov/vuln/detail/CVE-2015-3429
security-tracker.debian.org/tracker/CVE-2015-3429
ubuntu.com/security/CVE-2015-3429
cve.org/CVERecord?id=CVE-2015-3429