CVE-2016-1564: XSS
Published May 22, 2016
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet name or (2) template name to wp-admin/customize.php.
Affected Software
1 affected component
WordPress<=4.4.0
Remediation
Patch Available
Event History
May 22, 2016
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Data Sourced
via OSV·01:59 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2016-1564?
CVE-2016-1564 has a medium severity due to its cross-site scripting (XSS) vulnerabilities which can lead to potential remote code execution.
2
How do I fix CVE-2016-1564?
To fix CVE-2016-1564, update your WordPress installation to version 4.4.1 or later.
3
What platforms are affected by CVE-2016-1564?
CVE-2016-1564 affects WordPress versions prior to 4.4.1.
4
What type of attacks can be executed via CVE-2016-1564?
CVE-2016-1564 can allow attackers to inject arbitrary web scripts or HTML through XSS attacks.
5
When was CVE-2016-1564 disclosed?
CVE-2016-1564 was disclosed in January 2016.