Description

Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a widget title.

Remediation

References

CVE-2015-5732

Related Vulnerabilities

WordPress Plugin Zendesk Chat Cross-Site Request Forgery (1.4.5)

IBM RTC Improper Restriction of XML External Entity Reference Vulnerability (CVE-2017-1103)

Apache HTTP Server CVE-2003-0789 Vulnerability (CVE-2003-0789)

PHP Other Vulnerability (CVE-2007-1454)

WordPress Plugin Logo Carousel Cross-Site Scripting (1.7.1)

Severity

Medium

Classification

CVE-2015-5732 CWE-707

Tags

Missing Update Known Vulnerabilities