Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment.

Versions of WordPress 3.7.x prior to 3.7.6 , 3.8.x prior to 3.8.6 , 3.9.x prior to 3.9.4 , and 4.1.x prior to 4.1.2 are susceptible to the following vulnerabilities : 

 - An unspecified flaw exists that allows an attacker to upload arbitrary files with invalid or unsafe names. Note that this only affects versions 4.1 and higher.
 - A cross-site scripting vulnerability exists due to improper validation of user-supplied input. A remote attacker, using a specially crafted request, can exploit this to execute arbitrary script code in a user's browser session.
 - A limited cross-site scripting vulnerability exists due to improper validation of user-supplied input. A remote attacker, using a specially crafted request, can exploit this to execute arbitrary script code in a user's browser session. Note that this only affects versions 3.9 and higher.
 - An unspecified SQL injection vulnerability exists in some plugins.

In the Debian squeeze-lts version of Wordpress, multiple security issues have been fixed :

Remote attackers could...

  - ... upload files with invalid or unsafe names

  - ... mount social engineering attacks

  - ... compromise a site via cross-site scripting

  - ... inject SQL commands

  - ... cause denial of service or information disclosure

CVE-2014-9031

Jouko Pynnonen discovered an unauthenticated cross site scripting vulnerability (XSS) in wptexturize(), exploitable via comments or posts.

CVE-2014-9033

Cross site request forgery (CSRF) vulnerability in the password changing process, which could be used by an attacker to trick an user into changing her password.

CVE-2014-9034

Javier Nieto Arevalo and Andres Rojas Guerrero reported a potential denial of service in the way the phpass library is used to handle passwords, since no maximum password length was set.

CVE-2014-9035

John Blackbourn reported an XSS in the 'Press This' function (used for quick publishing using a browser 'bookmarklet').

CVE-2014-9036

Robert Chapin reported an XSS in the HTML filtering of CSS in posts.

CVE-2014-9037

David Anderson reported a hash comparison vulnerability for passwords stored using the old-style MD5 scheme. While unlikely, this could be exploited to compromise an account, if the user had not logged in after a Wordpress 2.5 update (uploaded to Debian on 2 Apr, 2008) and the password MD5 hash could be collided with due to PHP dynamic comparison.

CVE-2014-9038

Ben Bidner reported a server side request forgery (SSRF) in the core HTTP layer which unsufficiently blocked the loopback IP address space.

CVE-2014-9039

Momen Bassel, Tanoy Bose, and Bojan Slavkovic reported a vulnerability in the password reset process: an email address change would not invalidate a previous password reset email.

CVE-2015-3438

Cedric Van Bockhaven reported and Gary Pendergast, Mike Adams, and Andrew Nacin of the WordPress security team fixed a cross-site-scripting vulnerabilitity, which could enable anonymous users to compromise a site. 

CVE-2015-3439

Jakub Zoczek discovered a very limited cross-site scripting vulnerability, that could be used as part of a social engineering attack.

CVE-2015-3440

Jouko Pynn&ouml;nen discovered a cross-site scripting vulnerability, which could enable commenters to compromise a site.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**WordPress 4.2 'Powell' **

  - Upstream announcement     https://wordpress.org/news/2015/04/powell/

**WordPress 4.2.1 Security Release**

  - Upstream announcement     https://wordpress.org/news/2015/04/wordpress-4-2-1/

**WordPress 4.2.2 Security and Maintenance Release**

  - Upstream announcement     https://wordpress.org/news/2015/05/wordpress-4-2-2/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**WordPress 4.2 'Powell' **

  - Upstream announcement     https://wordpress.org/news/2015/04/powell/

**WordPress 4.2.1 Security Release**

  - Upstream announcement     https://wordpress.org/news/2015/04/wordpress-4-2-1/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues have been discovered in Wordpress, a weblog manager, that could allow remote attackers to upload files with invalid or unsafe names, mount social engineering attacks or compromise a site via cross-site scripting, and inject SQL commands.

More information can be found in the upstream advisories at and

According to its version number, the WordPress application running on the remote web server is potentially affected by multiple vulnerabilities :

  - An unspecified flaw exists that allows an attacker to     upload arbitrary files with invalid or unsafe names.
    Note that this only affects versions 4.1 and higher.

  - A cross-site scripting vulnerability exists due to     improper validation of user-supplied input. A remote     attacker, using a specially crafted request, can exploit     this to execute arbitrary script code in a user's     browser session.

  - A limited cross-site scripting vulnerability exists due     to improper validation of user-supplied input. A remote     attacker, using a specially crafted request, can exploit     this to execute arbitrary script code in a user's     browser session. Note that this only affects versions     3.9 and higher.

  - An unspecified SQL injection vulnerability exists in     some plugins.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
9026	WordPress < 3.7.6 / 3.8.x < 3.8.6 / 3.9.x < 3.9.4 / 4.1.x < 4.1.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high
83918	Debian DLA-236-1 : wordpress security update	Nessus	Debian Local Security Checks	medium
83751	Fedora 21 : wordpress-4.2.2-1.fc21 (2015-6808)	Nessus	Fedora Local Security Checks	medium
83750	Fedora 20 : wordpress-4.2.2-1.fc20 (2015-6790)	Nessus	Fedora Local Security Checks	medium
83315	Fedora 22 : wordpress-4.2.1-1.fc22 (2015-6778)	Nessus	Fedora Local Security Checks	medium
83236	Debian DSA-3250-1 : wordpress - security update	Nessus	Debian Local Security Checks	medium
83053	WordPress < 3.7.6 / 3.8.6 / 3.9.4 / 4.1.2 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2015-3438

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium