CVE-2015-3438: debian debian_linux Cross-site Scripting
Vulnerability summary
CVE-2015-3438 is a high (CVSS 7.2) Cross-site Scripting vulnerability in debian debian_linux. EPSS estimates a 7.39% chance of exploitation in the next 30 days, higher than 94.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 05-08-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment.
CVSS metrics
2 scores · 2 sources · 2 versionsEPSS trend
Probability
7.39%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 7.39% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (cedricvb.be)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- wordpress< 4.2+dfsg-1
- debian_linuxEOL7.0 | 8.0
Wordpress2 products
- wordpress< 3.7 (fixed in 3.7.6) | ≥ 3.7, ≤ 3.7.5 (fixed in 3.7.6) | ≥ 3.8, ≤ 3.8.5 (fixed in 3.7.6) | ≥ 3.9, ≤ 3.9.3 (fixed in 3.7.6) | ≥ 4.0, ≤ 4.0.1 (fixed in 3.7.6) | ≥ 4.1, ≤ 4.1.1 (fixed in 3.7.6)
- wordpress≤ 4.1.1
Ubuntu1 product
- wordpress< 4.4.2+dfsg-1ubuntu1
3 vendors · 5 products
References
14 links- lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.htmlVendor AdvisoryX Refsource FEDORA
- wpvulndb.com/vulnerabilities/7929X Refsource MISC
- lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.htmlVendor AdvisoryX Refsource FEDORA
- lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.htmlVendor AdvisoryX Refsource FEDORA