Detections
Analytics
WordPress < 4.3.1 Multiple Vulnerabilities
medium Nessus Network Monitor Plugin ID 9032
Synopsis
The remote server is hosting an outdated installation of WordPress that is vulnerable to multiple attack vectors.Description
Versions of WordPress prior to 4.3.1 are susceptible to the following vulnerabilities :- A cross-site scripting vulnerability exists when processing shortcode tags due to improper validation of user-supplied input. An attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2015-5714)
- A cross-site scripting (XSS) vulnerability affects the User List. This flaw exists because the program does not validate input to user list tables before returning it to users. (CVE-2015-7989)
- An unspecified vulnerability exists that allows an authenticated attacker to publish private posts and make them 'sticky'. (CVE-2015-5715)
Solution
Upgrade to WordPress 4.3.1, or later.See Also
http://codex.wordpress.org/Version_4.3.1
Plugin Details
Severity: Medium
ID: 9032
Family: CGI
Published: 12/17/2015
Updated: 3/6/2019
Nessus ID: 85985
Risk Information
VPR
Risk Factor: Low
Score: 3.0
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS v3
Risk Factor: Medium
Base Score: 4
Temporal Score: 3.5
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:wordpress:wordpress
Patch Publication Date: 9/15/2015
Vulnerability Publication Date: 9/15/2015