{"id":"CVE-2014-9035","aliases":["DEBIAN-CVE-2014-9035","DLA-236-1","DSA-3085-1","EUVD-2014-8863","GHSA-h62c-3j33-j9pq","MGASA-2014-0493"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3...","description":"Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02421,"percentile":0.84284,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2014-11-25T23:00:00Z","modified":"2026-10-23T15:47:34Z","fixes":[{"ecosystem":"Debian:12","package":"wordpress","fixed_in":["4.0.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wordpress","fixed_in":["4.0.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wordpress","fixed_in":["4.0.1+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1+dfsg-1~deb6u6"}]}],"versions":["3.0.4+dfsg-1","3.0.5+dfsg-0+squeeze1","3.0.5+dfsg-1","3.2.1+dfsg-1","3.2.1+dfsg-2","3.2.1+dfsg-3","3.3+dfsg-1","3.3.1+dfsg-1","3.3.2+dfsg-1","3.3.2+dfsg-1~squeeze1","3.4+dfsg-1","3.4+dfsg-2","3.4+dfsg-3","3.4.1+dfsg-1","3.4.2+dfsg-1","3.5+dfsg-1","3.5.1+dfsg-1","3.5.1+dfsg-2","3.5.2+dfsg-1","3.5.2+dfsg-1~deb6u1","3.5.2+dfsg-1~deb7u1","3.6+dfsg-1","3.6.1+dfsg-1~deb6u1","3.6.1+dfsg-1~deb6u2","3.6.1+dfsg-1~deb6u3","3.6.1+dfsg-1~deb6u4","3.6.1+dfsg-1~deb6u5"],"bundled":11},{"source":"osv","ecosystem":"Debian:7","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1+dfsg-1~deb7u5"}]}],"versions":["3.5.1+dfsg-2","3.5.2+dfsg-1","3.5.2+dfsg-1~deb6u1","3.5.2+dfsg-1~deb7u1","3.6+dfsg-1","3.6.1+dfsg-1~deb6u1","3.6.1+dfsg-1~deb6u2","3.6.1+dfsg-1~deb6u3","3.6.1+dfsg-1~deb6u4","3.6.1+dfsg-1~deb6u5","3.6.1+dfsg-1~deb6u6","3.6.1+dfsg-1~deb6u7","3.6.1+dfsg-1~deb6u8","3.6.1+dfsg-1~deb6u9","3.6.1+dfsg-1~deb7u1","3.6.1+dfsg-1~deb7u2","3.6.1+dfsg-1~deb7u3","3.6.1+dfsg-1~deb7u4"],"bundled":8},{"source":"osv","ecosystem":"Mageia:3","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-1.mga3"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-1.mga4"}]}],"bundled":9}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"wordpress","product":"wordpress"}],"references":[{"url":"http://www.debian.org/security/2014/dsa-3085","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://openwall.com/lists/oss-security/2014/11/25/12","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://advisories.mageia.org/MGASA-2014-0493.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://www.securitytracker.com/id/1031243","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/71236","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:233","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"https://wordpress.org/news/2014/11/wordpress-4-0-1/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9035"},{"url":"https://wordpress.org/news/2014/11/wordpress-4-0-1"},{"url":"https://github.com/advisories/GHSA-h62c-3j33-j9pq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9035","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0493.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14625","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-9035","description":"Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2014-11-25T23:00:00Z","modified":"2024-08-06T13:33:13.413Z","updated_at":"2026-11-02T14:33:42.882687Z"}],"euvd":[{"id":"EUVD-2014-8863","description":"Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2014-11-25T23:00:00Z","modified":"2024-08-06T13:33:13Z","updated_at":"2026-11-03T01:56:50.141542Z"}],"ghsa":[{"id":"GHSA-h62c-3j33-j9pq","title":"Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3...","description":"Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2022-05-17T03:57:42Z","modified":"2025-04-12T12:43:22Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:01:19.873405Z"}],"nvd":[{"id":"CVE-2014-9035","description":"Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2014-11-25T23:59:06.227Z","modified":"2026-06-17T00:17:42.033Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"CVE-2014-9035","description":"Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2014-11-25T23:59:06Z","modified":"2026-04-16T06:22:30.75458357Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9035","description":"Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2014-11-25T23:59:06.227Z","modified":"2026-10-23T15:47:34.837128516Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"DLA-236-1","title":"wordpress - security update","status":"published","published":"2015-06-01T00:00:00Z","modified":"2026-03-09T01:23:07.883089Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-3085-1","title":"wordpress - security update","status":"published","published":"2014-12-03T00:00:00Z","modified":"2026-03-09T01:17:49.14377Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0493","title":"Updated wordpress package fixes security vulnerabilities","description":"XSS in wptexturize() via comments or posts, exploitable for unauthenticated users (CVE-2014-9031).\n\nXSS in media playlists (CVE-2014-9032).\n\nCSRF in the password reset process (CVE-2014-9033).\n\nDenial of service for giant passwords. The phpass library by Solar Designer\nwas used in both projects without setting a maximum password length, which\ncan lead to CPU exhaustion upon hashing (CVE-2014-9034).\n\nXSS in Press This (CVE-2014-9035).\n\nXSS in HTML filtering of CSS in posts (CVE-2014-9036).\n\nHash comparison vulnerability in old-style MD5-stored passwords\n(CVE-2014-9037).\n\nSSRF: Safe HTTP requests did not sufficiently block the loopback IP address\nspace (CVE-2014-9038).\n\nPreviously an email address change would not invalidate a previous password\nreset email (CVE-2014-9039).\n","status":"published","published":"2014-11-26T17:29:06Z","modified":"2026-04-16T06:24:11.966579605Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}