The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors.

Versions of WordPress prior to 4.3.1 are susceptible to the following vulnerabilities : 

 - A cross-site scripting vulnerability exists when processing shortcode tags due to improper validation of user-supplied input.  An attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2015-5714)
 - A cross-site scripting (XSS) vulnerability affects the User List. This flaw exists because the program does not validate input to user list tables before returning it to users. (CVE-2015-7989)
 - An unspecified vulnerability exists that allows an authenticated attacker to publish private posts and make them 'sticky'. (CVE-2015-5715)

Several vulnerabilities were discovered in Wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-2213     SQL Injection allowed a remote attacker to compromise     the site.

  - CVE-2015-5622     The robustness of the shortcodes HTML tags filter has     been improved. The parsing is a bit more strict, which     may affect your installation.

  - CVE-2015-5714     A cross-site scripting vulnerability when processing     shortcode tags.

  - CVE-2015-5715     A vulnerability has been discovered, allowing users     without proper permissions to publish private posts and     make them sticky.

  - CVE-2015-5731     An attacker could lock a post that was being edited.

  - CVE-2015-5732     Cross-site scripting in a widget title allows an     attacker to steal sensitive information.

  - CVE-2015-5734     Fix some broken links in the legacy theme preview.

  - CVE-2015-7989     A cross-site scripting vulnerability in user list     tables.

Several vulnerabilities have been fixed in Wordpress, the popular blogging engine.

  - CVE-2015-5714     A cross-site scripting vulnerability when processing     shortcode tags has been discovered.

  The issue has been fixed by not allowing unclosed HTML elements in   attributes.

  - CVE-2015-5715     A vulnerability has been discovered, allowing users     without proper permissions to publish private posts and     make them sticky.

  The issue has been fixed in the XMLRPC code of Wordpress by not   allowing private posts to be sticky.

  - CVE-2015-7989     A cross-site scripting vulnerability in user list tables     has been discovered.

  The issue has been fixed by URL-escaping email addresses in those   user lists.

Various security issue have been fixed in the Debian LTS (squeeze) version of the Wordpress content management system.

CVE-2015-5714

A cross-site scripting vulnerability when processing shortcode tags has been discovered.

The issue has been fixed by not allowing unclosed HTML elements in attributes.

CVE-2015-5715

A vulnerability has been discovered, allowing users without proper permissions to publish private posts and make them sticky.

The issue has been fixed in the XMLRPC code of Wordpress by not allowing private posts to be sticky.

Other issue(s)

A cross-site scripting vulnerability in user list tables has been discovered.

The issue has been fixed by URL-escaping email addresses in those user lists.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**WordPress 4.3.1 Security and Maintenance Release** [Upstream announcement](https://wordpress.org/news/2015/09/wordpress-4-3-1/):
WordPress 4.3.1 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. This release addresses three issues, including two cross-site scripting vulnerabilities and a potential privilege escalation. * WordPress versions 4.3 and earlier are vulnerable to a cross-site scripting vulnerability when processing shortcode tags (CVE-2015-5714). Reported by Shahar Tal and Netanel Rubin of Check Point. * A separate cross-site scripting vulnerability was found in the user list table. Reported by Ben Bidner of the WordPress security team. * Finally, in certain cases, users without proper permissions could publish private posts and make them sticky (CVE-2015-5715).
Reported by Shahar Tal and Netanel Rubin of Check Point. WordPress 4.3.1 also fixes twenty-six bugs. For more information, see the [release notes](https://codex.wordpress.org/Version_4.3.1) or consult the [list of changes](https://core.trac.wordpress.org/log/branches/4.3/?rev=34199&s t op_rev=33647).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its version number, the WordPress application running on the remote web server is prior to 4.3.1. It is, therefore, potentially affected by multiple vulnerabilities :

  - A cross-site scripting vulnerability exists when     processing shortcode tags due to improper validation of     user-supplied input. An attacker can exploit this, via a     specially crafted request, to execute arbitrary script     code in a user's browser session. (CVE-2015-5714)

  - An unspecified vulnerability exists that allows an     authenticated attacker to publish private posts and make     them 'sticky'. (CVE-2015-5715)

  - An unspecified cross-site scripting vulnerability exists     in the user list table. An attacker can exploit this,     via a specially crafted request, to execute arbitrary     script code in a user's browser session.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Samuel Sidler reports :

WordPress 4.3.1 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

- WordPress versions 4.3 and earlier are vulnerable to a cross-site scripting vulnerability when processing shortcode tags (CVE-2015-5714). Reported by Shahar Tal and Netanel Rubin of Check Point.

- A separate cross-site scripting vulnerability was found in the user list table. Reported by Ben Bidner of the WordPress security team.

- Finally, in certain cases, users without proper permissions could publish private posts and make them sticky (CVE-2015-5715). Reported by Shahar Tal and Netanel Rubin of Check Point.

ID	Name	Product	Family	Severity
9032	WordPress < 4.3.1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
86666	Debian DSA-3383-1 : wordpress - security update	Nessus	Debian Local Security Checks	medium
86448	Debian DSA-3375-1 : wordpress - security update	Nessus	Debian Local Security Checks	medium
86213	Debian DLA-321-1 : wordpress security update	Nessus	Debian Local Security Checks	medium
86166	Fedora 23 : wordpress-4.3.1-1.fc23 (2015-15983)	Nessus	Fedora Local Security Checks	medium
86165	Fedora 21 : wordpress-4.3.1-1.fc21 (2015-15982)	Nessus	Fedora Local Security Checks	medium
86164	Fedora 22 : wordpress-4.3.1-1.fc22 (2015-15981)	Nessus	Fedora Local Security Checks	medium
85985	WordPress < 4.3.1 Multiple Vulnerabilities	Nessus	CGI abuses	medium
85957	FreeBSD : wordpress -- multiple vulnerabilities (f4ce64c2-5bd4-11e5-9040-3c970e169bc2)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-5715

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium