CVE-2015-3429: automattic genericons Cross-site Scripting
Vulnerability summary
CVE-2015-3429 is a medium (CVSS 6.4) Cross-site Scripting vulnerability in automattic genericons. EPSS estimates a 3.91% chance of exploitation in the next 30 days, higher than 90.1% of scored vulnerabilities. 3 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 17-06-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
CVSS metrics
2 scores · 2 sources · 2 versionsEPSS trend
Probability
3.91%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
-0.03 pp
From 3.94% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (digitalocean.com)
Maturity: unknown
Exploit Reference (netsparker.com)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- wordpress< 4.2.2+dfsg-1
- debian_linuxEOL8.0
Wordpress2 products
- wordpress< 3.7 (fixed in 3.7.8) | ≥ 3.7, ≤ 3.7.7 (fixed in 3.7.8) | ≥ 3.8, ≤ 3.8.7 (fixed in 3.7.8) | ≥ 3.9, ≤ 3.9.5 (fixed in 3.7.8) | ≥ 4.0, ≤ 4.0.4 (fixed in 3.7.8) | ≥ 4.1, ≤ 4.1.4 (fixed in 3.7.8) | ≥ 4.2, ≤ 4.2.1 (fixed in 3.7.8)
- twentyfifteen≤ 1.1 (fixed in 1.2)
Automattic1 product
- genericons≤ 3.3
Ubuntu1 product
- wordpress< 4.4.2+dfsg-1ubuntu1
4 vendors · 6 products
References
16 links- wpvulndb.com/vulnerabilities/7965X Refsource MISC
- lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.htmlVendor AdvisoryX Refsource FEDORA
- www.netsparker.com/cve-2015-3429-dom-xss-vulnerability-in-twenty-fifteen-wordpress-theme/X Refsource MISCExploitREPORT
Show all 16 references
- lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.htmlVendor AdvisoryX Refsource FEDORA