{"id":"CVE-2015-5714","aliases":["DEBIAN-CVE-2015-5714","DLA-321-1","DSA-3375-1","DSA-3383-1","EUVD-2015-5661","GHSA-92h3-fjv6-rmmc","MGASA-2015-0377","UBUNTU-CVE-2015-5714"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to...","description":"Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.06937,"percentile":0.94155,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2015-09-17T18:02:40Z","modified":"2026-09-09T07:01:29Z","fixes":[{"ecosystem":"Debian:12","package":"wordpress","fixed_in":["4.3.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wordpress","fixed_in":["4.3.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wordpress","fixed_in":["4.3.1+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1+dfsg-1~deb6u8"}]}],"versions":["3.0.4+dfsg-1","3.0.5+dfsg-0+squeeze1","3.0.5+dfsg-1","3.2.1+dfsg-1","3.2.1+dfsg-2","3.2.1+dfsg-3","3.3+dfsg-1","3.3.1+dfsg-1","3.3.2+dfsg-1","3.3.2+dfsg-1~squeeze1","3.4+dfsg-1","3.4+dfsg-2","3.4+dfsg-3","3.4.1+dfsg-1","3.4.2+dfsg-1","3.5+dfsg-1","3.5.1+dfsg-1","3.5.1+dfsg-2","3.5.2+dfsg-1","3.5.2+dfsg-1~deb6u1","3.5.2+dfsg-1~deb7u1","3.6+dfsg-1","3.6.1+dfsg-1~deb6u1","3.6.1+dfsg-1~deb6u2","3.6.1+dfsg-1~deb6u3","3.6.1+dfsg-1~deb6u4","3.6.1+dfsg-1~deb6u5","3.6.1+dfsg-1~deb6u6","3.6.1+dfsg-1~deb6u7"],"bundled":3},{"source":"osv","ecosystem":"Debian:8","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1+dfsg-1+deb8u5"}]}],"versions":["4.1+dfsg-1","4.1+dfsg-1+deb8u1","4.1+dfsg-1+deb8u2","4.1+dfsg-1+deb8u3","4.1+dfsg-1+deb8u4"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1+dfsg-1~deb7u8"}]}],"versions":["3.5.1+dfsg-2","3.5.2+dfsg-1","3.5.2+dfsg-1~deb6u1","3.5.2+dfsg-1~deb7u1","3.6+dfsg-1","3.6.1+dfsg-1~deb6u1","3.6.1+dfsg-1~deb6u2","3.6.1+dfsg-1~deb6u3","3.6.1+dfsg-1~deb6u4","3.6.1+dfsg-1~deb6u5","3.6.1+dfsg-1~deb6u6","3.6.1+dfsg-1~deb6u7","3.6.1+dfsg-1~deb6u8","3.6.1+dfsg-1~deb6u9","3.6.1+dfsg-1~deb7u1","3.6.1+dfsg-1~deb7u2","3.6.1+dfsg-1~deb7u3","3.6.1+dfsg-1~deb7u4","3.6.1+dfsg-1~deb7u5","3.6.1+dfsg-1~deb7u6"],"bundled":8},{"source":"osv","ecosystem":"Mageia:4","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.9-1.mga4"}]}],"bundled":2}],"products":[{"vendor":"wordpress","product":"wordpress"}],"references":[{"url":"https://wpvulndb.com/vulnerabilities/8186","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://codex.wordpress.org/Version_4.3.1","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://www.debian.org/security/2015/dsa-3375","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://github.com/WordPress/WordPress/commit/f72b21af23da6b6d54208e5c1d65ececdaa109c8","tags":["x_refsource_CONFIRM","x_transferred","fix","report"]},{"url":"https://wordpress.org/news/2015/09/wordpress-4-3-1/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web","report"]},{"url":"http://www.securitytracker.com/id/1033979","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3383","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-5714","tags":["x_refsource_CONFIRM","x_transferred","web","advisory"]},{"url":"http://www.securityfocus.com/bid/76745","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5714"},{"url":"https://wordpress.org/news/2015/09/wordpress-4-3-1"},{"url":"https://github.com/advisories/GHSA-92h3-fjv6-rmmc"},{"url":"https://advisories.mageia.org/MGASA-2015-0377.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16763","tags":["report"]},{"url":"https://codex.wordpress.org/Version_3.9.9","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-5714","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5714","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-5714","description":"Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.","status":"published","published":"2016-05-22T01:00:00Z","modified":"2024-08-06T06:59:04.355Z","updated_at":"2026-11-02T14:35:40.217028Z"}],"euvd":[{"id":"EUVD-2015-5661","description":"Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.","status":"published","published":"2016-05-22T01:00:00Z","modified":"2024-08-06T06:59:04Z","updated_at":"2026-11-03T02:21:58.760301Z"}],"ghsa":[{"id":"GHSA-92h3-fjv6-rmmc","title":"Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to...","description":"Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.","status":"published","published":"2022-05-17T00:28:15Z","modified":"2025-04-12T13:01:27Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:01:28.050499Z"}],"nvd":[{"id":"CVE-2015-5714","description":"Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.","status":"published","published":"2016-05-22T01:59:01.413Z","modified":"2026-06-17T00:29:38.49Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"CVE-2015-5714","description":"Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.","status":"published","published":"2016-05-22T01:59:01Z","modified":"2026-04-16T06:26:23.798347966Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-5714","description":"Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.","status":"published","published":"2016-05-22T01:59:01.413Z","modified":"2026-09-09T07:01:29.961976426Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"UBUNTU-CVE-2015-5714","description":"Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.","status":"withdrawn","published":"2016-05-22T01:59:00Z","modified":"2025-07-16T07:33:13.356527Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"DLA-321-1","title":"wordpress - security update","status":"published","published":"2015-09-30T00:00:00Z","modified":"2026-03-09T01:22:54.356807Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-3375-1","title":"wordpress - security update","status":"published","published":"2015-10-19T00:00:00Z","modified":"2026-03-09T01:18:45.845222Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3383-1","title":"wordpress - security update","status":"published","published":"2015-10-29T00:00:00Z","modified":"2026-03-09T01:17:48.512063Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0377","title":"Updated wordpress package fixes security vulnerabilities","description":"Updated wordpress packages fixes security vulnerabilities:\n\nThe wordpress package has been updated to version 3.9.9, fixing two\ncross-site scripting issues and a potential privilege escalation issue\n(CVE-2015-5714, CVE-2015-5715), as well as other bugs.  See the upstream\nannouncement and release notes for more details.\n","status":"published","published":"2015-09-17T18:02:40Z","modified":"2026-04-16T06:26:24.335738683Z","updated_at":"2026-11-02T15:49:39.792687Z"}]}}