Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.

Several vulnerabilities have been found in Wordpress, the popular blogging engine.

  - CVE-2015-3429     The file example.html in the Genericicons icon font     package and twentyfifteen Wordpress theme allowed for     cross site scripting.

  - CVE-2015-5622     The robustness of the shortcodes HTML tags filter has     been improved. The parsing is a bit more strict, which     may affect your installation.

  - CVE-2015-5623     A cross site scripting vulnerability allowed users with     the Contributor or Author role to elevate their     privileges.

The oldstable distribution (wheezy) is only affected by CVE-2015-5622.
This less critical issue will be fixed at a later time.

**WordPress 4.2 'Powell' **

  - Upstream announcement     https://wordpress.org/news/2015/04/powell/

**WordPress 4.2.1 Security Release**

  - Upstream announcement     https://wordpress.org/news/2015/04/wordpress-4-2-1/

**WordPress 4.2.2 Security and Maintenance Release**

  - Upstream announcement     https://wordpress.org/news/2015/05/wordpress-4-2-2/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
85352	Debian DSA-3328-1 : wordpress - security update	Nessus	Debian Local Security Checks	medium
83751	Fedora 21 : wordpress-4.2.2-1.fc21 (2015-6808)	Nessus	Fedora Local Security Checks	medium
83750	Fedora 20 : wordpress-4.2.2-1.fc20 (2015-6790)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2015-3429

medium

Tenable Plugins

medium

medium

medium