Description

Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string.

Remediation

References

CVE-2015-5734

Related Vulnerabilities

PHP Other Vulnerability (CVE-2002-0229)

Dot CMS Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2016-10007)

WordPress Plugin Taxonomy Images Multiple Unspecified Vulnerabilities (0.6)

OpenSSL Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2012-2110)

WordPress Plugin Powerhouse Museum Collection Image Grid 'tbpv_username' Parameter Cross-Site Scripting (0.9.1.1)

Severity

Medium

Classification

CVE-2015-5734 CWE-707

Tags

Missing Update Known Vulnerabilities