Every CVE Search/ Get API key

CVE-2015-5622

Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated...

3.5 LowFix available

Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.

Exploit likelihood

4.91%Up 3.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 3.5

Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.

Record
CVE-2015-5622
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.

Record
CVE-2015-5622
Updated
2026-11-02
EUVDEUVD-2015-5574 No score

Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.

Record
EUVD-2015-5574
Updated
2026-11-03
GitHub AdvisoriesGHSA-cg2j-v6g7-3q66 No score

Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated...

Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.

Record
GHSA-cg2j-v6g7-3q66
Weakness
CWE-79
Updated
2026-11-02
OSV No score

Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.

Record
CVE-2015-5622
Updated
2026-11-02
OSVDEBIAN-CVE-2015-5622 No score

Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.

Record
DEBIAN-CVE-2015-5622
Updated
2026-11-02
OSVMGASA-2015-0290 No score

Updated wordpress package fixes security vulnerabilities

WordPress versions 4.2.2 and earlier are affected by a cross-site scripting vulnerability, which could allow users with the Contributor or Author role to compromise a site (CVE-2015-5622).

WordPress versions 4.2.2 and earlier are affected by an issue where it was possible for a user with Subscriber permissions to create a draft through Quick Draft (CVE-2015-5623).

Record
MGASA-2015-0290
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wordpress
Debian:12
 before 4.2.3+dfsg-1
4.2.3+dfsg-1
wordpress
Debian:13
 before 4.2.3+dfsg-1
4.2.3+dfsg-1
wordpress
Debian:14
 before 4.2.3+dfsg-1
4.2.3+dfsg-1
wordpress
Debian:6.0
From an advisory covering 5 CVEs
 before 3.6.1+dfsg-1~deb6u7, plus listed versions
3.0.4+dfsg-13.0.5+dfsg-0+squeeze13.0.5+dfsg-13.2.1+dfsg-13.2.1+dfsg-2
Show 23 moreShow less
3.2.1+dfsg-33.3+dfsg-13.3.1+dfsg-13.3.2+dfsg-13.3.2+dfsg-1~squeeze13.4+dfsg-13.4+dfsg-23.4+dfsg-33.4.1+dfsg-13.4.2+dfsg-13.5+dfsg-13.5.1+dfsg-13.5.1+dfsg-23.5.2+dfsg-13.5.2+dfsg-1~deb6u13.5.2+dfsg-1~deb7u13.6+dfsg-13.6.1+dfsg-1~deb6u13.6.1+dfsg-1~deb6u23.6.1+dfsg-1~deb6u33.6.1+dfsg-1~deb6u43.6.1+dfsg-1~deb6u53.6.1+dfsg-1~deb6u6
3.6.1+dfsg-1~deb6u7
wordpress
Debian:8
From an advisory covering 6 CVEs
 before 4.1+dfsg-1+deb8u4, plus listed versions
4.1+dfsg-14.1+dfsg-1+deb8u14.1+dfsg-1+deb8u24.1+dfsg-1+deb8u3
4.1+dfsg-1+deb8u4
wordpress
Debian:7
From an advisory covering 8 CVEs
 before 3.6.1+dfsg-1~deb7u8, plus listed versions
3.5.1+dfsg-23.5.2+dfsg-13.5.2+dfsg-1~deb6u13.5.2+dfsg-1~deb7u13.6+dfsg-1
Show 15 moreShow less
3.6.1+dfsg-1~deb6u13.6.1+dfsg-1~deb6u23.6.1+dfsg-1~deb6u33.6.1+dfsg-1~deb6u43.6.1+dfsg-1~deb6u53.6.1+dfsg-1~deb6u63.6.1+dfsg-1~deb6u73.6.1+dfsg-1~deb6u83.6.1+dfsg-1~deb6u93.6.1+dfsg-1~deb7u13.6.1+dfsg-1~deb7u23.6.1+dfsg-1~deb7u33.6.1+dfsg-1~deb7u43.6.1+dfsg-1~deb7u53.6.1+dfsg-1~deb7u6
3.6.1+dfsg-1~deb7u8
wordpress
Mageia:4
From an advisory covering 2 CVEs
 before 3.9.7-1.mga4
3.9.7-1.mga4

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-5622 is a low vulnerability (CVSS 3.5) in Wordpress, published July 27, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.91%, the 92nd percentile. Fixed in wordpress 4.2.3+dfsg-1.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open