CVE-2015-5622: XSS
Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5622?
CVE-2015-5622 has a medium severity rating, as it allows remote authenticated users to execute arbitrary scripts on affected WordPress sites.
How do I fix CVE-2015-5622?
To fix CVE-2015-5622, update your WordPress installation to version 4.2.3 or later.
Who is affected by CVE-2015-5622?
CVE-2015-5622 affects WordPress versions prior to 4.2.3, particularly installations where users have Author or Contributor roles.
What types of attacks can be executed through CVE-2015-5622?
CVE-2015-5622 allows attackers to perform cross-site scripting (XSS) attacks by injecting malicious scripts through shortcodes.
Is there a workaround for CVE-2015-5622 if I cannot update immediately?
A temporary workaround for CVE-2015-5622 is to revoke Author and Contributor access for users who do not require it.