Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address, a different vulnerability than CVE-2015-5714.

Versions of WordPress prior to 4.3.1 are susceptible to the following vulnerabilities : 

 - A cross-site scripting vulnerability exists when processing shortcode tags due to improper validation of user-supplied input.  An attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2015-5714)
 - A cross-site scripting (XSS) vulnerability affects the User List. This flaw exists because the program does not validate input to user list tables before returning it to users. (CVE-2015-7989)
 - An unspecified vulnerability exists that allows an authenticated attacker to publish private posts and make them 'sticky'. (CVE-2015-5715)

Several vulnerabilities were discovered in Wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-2213     SQL Injection allowed a remote attacker to compromise     the site.

  - CVE-2015-5622     The robustness of the shortcodes HTML tags filter has     been improved. The parsing is a bit more strict, which     may affect your installation.

  - CVE-2015-5714     A cross-site scripting vulnerability when processing     shortcode tags.

  - CVE-2015-5715     A vulnerability has been discovered, allowing users     without proper permissions to publish private posts and     make them sticky.

  - CVE-2015-5731     An attacker could lock a post that was being edited.

  - CVE-2015-5732     Cross-site scripting in a widget title allows an     attacker to steal sensitive information.

  - CVE-2015-5734     Fix some broken links in the legacy theme preview.

  - CVE-2015-7989     A cross-site scripting vulnerability in user list     tables.

Several vulnerabilities have been fixed in Wordpress, the popular blogging engine.

  - CVE-2015-5714     A cross-site scripting vulnerability when processing     shortcode tags has been discovered.

  The issue has been fixed by not allowing unclosed HTML elements in   attributes.

  - CVE-2015-5715     A vulnerability has been discovered, allowing users     without proper permissions to publish private posts and     make them sticky.

  The issue has been fixed in the XMLRPC code of Wordpress by not   allowing private posts to be sticky.

  - CVE-2015-7989     A cross-site scripting vulnerability in user list tables     has been discovered.

  The issue has been fixed by URL-escaping email addresses in those   user lists.

According to its version number, the WordPress application running on the remote web server is prior to 4.3.1. It is, therefore, potentially affected by multiple vulnerabilities :

  - A cross-site scripting vulnerability exists when     processing shortcode tags due to improper validation of     user-supplied input. An attacker can exploit this, via a     specially crafted request, to execute arbitrary script     code in a user's browser session. (CVE-2015-5714)

  - An unspecified vulnerability exists that allows an     authenticated attacker to publish private posts and make     them 'sticky'. (CVE-2015-5715)

  - An unspecified cross-site scripting vulnerability exists     in the user list table. An attacker can exploit this,     via a specially crafted request, to execute arbitrary     script code in a user's browser session.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Samuel Sidler reports :

WordPress 4.3.1 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

- WordPress versions 4.3 and earlier are vulnerable to a cross-site scripting vulnerability when processing shortcode tags (CVE-2015-5714). Reported by Shahar Tal and Netanel Rubin of Check Point.

- A separate cross-site scripting vulnerability was found in the user list table. Reported by Ben Bidner of the WordPress security team.

- Finally, in certain cases, users without proper permissions could publish private posts and make them sticky (CVE-2015-5715). Reported by Shahar Tal and Netanel Rubin of Check Point.

ID	Name	Product	Family	Severity
9032	WordPress < 4.3.1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
86666	Debian DSA-3383-1 : wordpress - security update	Nessus	Debian Local Security Checks	medium
86448	Debian DSA-3375-1 : wordpress - security update	Nessus	Debian Local Security Checks	medium
85985	WordPress < 4.3.1 Multiple Vulnerabilities	Nessus	CGI abuses	medium
85957	FreeBSD : wordpress -- multiple vulnerabilities (f4ce64c2-5bd4-11e5-9040-3c970e169bc2)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-7989

medium

Tenable Plugins

medium

medium

medium

medium

medium