{"id":"CVE-2015-3440","aliases":["DEBIAN-CVE-2015-3440","DLA-236-1","DSA-3250-1","EUVD-2015-3484","GHSA-xg6f-394q-j4f9","MGASA-2015-0202"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1...","description":"Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.16889,"percentile":0.9707,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2015-05-04T00:00:00Z","modified":"2026-09-09T06:47:27Z","exploits":[{"source":"exploitdb","id":"EDB-36844","title":"WordPress Core 4.2 - Persistent Cross-Site Scripting","type":"webapps","platform":"php","date":"2015-04-27","verified":true,"url":"https://www.exploit-db.com/exploits/36844"}],"fixes":[{"ecosystem":"Debian:12","package":"wordpress","fixed_in":["4.2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wordpress","fixed_in":["4.2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wordpress","fixed_in":["4.2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"wordpress","fixed_in":["3.9.6-1.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1+dfsg-1~deb6u6"}]}],"versions":["3.0.4+dfsg-1","3.0.5+dfsg-0+squeeze1","3.0.5+dfsg-1","3.2.1+dfsg-1","3.2.1+dfsg-2","3.2.1+dfsg-3","3.3+dfsg-1","3.3.1+dfsg-1","3.3.2+dfsg-1","3.3.2+dfsg-1~squeeze1","3.4+dfsg-1","3.4+dfsg-2","3.4+dfsg-3","3.4.1+dfsg-1","3.4.2+dfsg-1","3.5+dfsg-1","3.5.1+dfsg-1","3.5.1+dfsg-2","3.5.2+dfsg-1","3.5.2+dfsg-1~deb6u1","3.5.2+dfsg-1~deb7u1","3.6+dfsg-1","3.6.1+dfsg-1~deb6u1","3.6.1+dfsg-1~deb6u2","3.6.1+dfsg-1~deb6u3","3.6.1+dfsg-1~deb6u4","3.6.1+dfsg-1~deb6u5"],"bundled":11},{"source":"osv","ecosystem":"Debian:7","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1+dfsg-1~deb7u6"}]}],"versions":["3.5.1+dfsg-2","3.5.2+dfsg-1","3.5.2+dfsg-1~deb6u1","3.5.2+dfsg-1~deb7u1","3.6+dfsg-1","3.6.1+dfsg-1~deb6u1","3.6.1+dfsg-1~deb6u2","3.6.1+dfsg-1~deb6u3","3.6.1+dfsg-1~deb6u4","3.6.1+dfsg-1~deb6u5","3.6.1+dfsg-1~deb6u6","3.6.1+dfsg-1~deb6u7","3.6.1+dfsg-1~deb6u8","3.6.1+dfsg-1~deb6u9","3.6.1+dfsg-1~deb7u1","3.6.1+dfsg-1~deb7u2","3.6.1+dfsg-1~deb7u3","3.6.1+dfsg-1~deb7u4","3.6.1+dfsg-1~deb7u5"],"bundled":3},{"source":"osv","ecosystem":"Debian:8","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1+dfsg-1+deb8u1"}]}],"versions":["4.1+dfsg-1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.6-1.mga4"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"wordpress","product":"wordpress"}],"references":[{"url":"https://www.exploit-db.com/exploits/36844/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","evidence"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://codex.wordpress.org/Version_4.2.1","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://klikki.fi/adv/wordpress2.html","tags":["x_refsource_MISC","x_transferred","Exploit","evidence"]},{"url":"https://wpvulndb.com/vulnerabilities/7945","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://wordpress.org/news/2015/04/wordpress-4-2-1/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/74334","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2015/Apr/84","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","evidence"]},{"url":"https://core.trac.wordpress.org/changeset/32299","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://osvdb.org/show/osvdb/121320","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1032199","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3250","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/131644/WordPress-4.2-Cross-Site-Scripting.html","tags":["x_refsource_MISC","x_transferred","Exploit","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3440"},{"url":"https://wordpress.org/news/2015/04/wordpress-4-2-1"},{"url":"https://www.exploit-db.com/exploits/36844"},{"url":"https://github.com/advisories/GHSA-xg6f-394q-j4f9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3440","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0202.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15786","tags":["report"]},{"url":"http://codex.wordpress.org/Version_3.9.5","tags":["web"]},{"url":"http://codex.wordpress.org/Version_3.9.6","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-3440","description":"Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.","status":"published","published":"2015-08-03T14:00:00Z","modified":"2024-08-06T05:47:57.7Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3484","description":"Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.","status":"published","published":"2015-08-03T14:00:00Z","modified":"2024-08-06T05:47:57Z","updated_at":"2026-11-03T02:22:08.106657Z"}],"ghsa":[{"id":"GHSA-xg6f-394q-j4f9","title":"Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1...","description":"Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.","status":"published","published":"2022-05-17T03:30:00Z","modified":"2025-04-12T12:50:28Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:01:22.814855Z"}],"nvd":[{"id":"CVE-2015-3440","description":"Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.","status":"published","published":"2015-08-03T14:59:00.103Z","modified":"2026-06-17T00:25:56.003Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:07.96297Z"}],"osv":[{"id":"CVE-2015-3440","description":"Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.","status":"published","published":"2015-08-03T14:59:00Z","modified":"2026-04-16T06:22:32.443160254Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3440","description":"Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.","status":"published","published":"2015-08-03T14:59:00.103Z","modified":"2026-09-09T06:47:27.842111708Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DLA-236-1","title":"wordpress - security update","status":"published","published":"2015-06-01T00:00:00Z","modified":"2026-03-09T01:23:07.883089Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-3250-1","title":"wordpress - security update","status":"published","published":"2015-05-04T00:00:00Z","modified":"2026-03-09T01:19:01.732066Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2015-0202","title":"Updated wordpress packages fix security vulnerabilities","description":"Updated wordpress packages fixes security vulnerabilities:\n\nThe wordpress package has been updated to version 3.9.6, which fixes multiple\ncross-site scripting issues, including CVE-2015-3440, and other bugs.\n\nNote that upstream has advised us that WordPress 3.9.x is no longer supported.\nAs this package is unmaintained, this may be the last update for this package.\nDownloading the latest version from upstream and using that, as well as making\nuse of its aut-update capability, may be preferrable to using this package.\n","status":"published","published":"2015-05-08T23:54:13Z","modified":"2026-04-16T06:24:55.866309248Z","updated_at":"2026-11-02T15:49:39.792687Z"}]}}