{"api_version":"1","generated_at":"2026-07-23T08:33:38+00:00","cve":"CVE-2015-5714","urls":{"html":"https://cve.report/CVE-2015-5714","api":"https://cve.report/api/cve/CVE-2015-5714.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-5714","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-5714"},"summary":{"title":"CVE-2015-5714","description":"Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.","state":"PUBLISHED","assigner":"mitre","published_at":"2016-05-22 01:59:01","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"6.1","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.debian.org/security/2015/dsa-3383","name":"http://www.debian.org/security/2015/dsa-3383","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Debian -- Security Information -- DSA-3383-1 wordpress","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/76745","name":"http://www.securityfocus.com/bid/76745","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"WordPress CVE-2015-5714 Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-5714","name":"https://security-tracker.debian.org/tracker/CVE-2015-5714","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CVE-2015-5714","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1033979","name":"http://www.securitytracker.com/id/1033979","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"WordPress Bugs Let Remote Users Conduct Cross-Site Scripting Attacks and Bypass Publishing Permission Checks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2015/dsa-3375","name":"http://www.debian.org/security/2015/dsa-3375","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Debian -- Security Information -- DSA-3375-1 wordpress","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/WordPress/WordPress/commit/f72b21af23da6b6d54208e5c1d65ececdaa109c8","name":"https://github.com/WordPress/WordPress/commit/f72b21af23da6b6d54208e5c1d65ececdaa109c8","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Shortcodes: don't allow unclosed HTML elements in attributes · WordPress/WordPress@f72b21a · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://codex.wordpress.org/Version_4.3.1","name":"https://codex.wordpress.org/Version_4.3.1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Version 4.3.1 « WordPress Codex","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://wordpress.org/news/2015/09/wordpress-4-3-1/","name":"https://wordpress.org/news/2015/09/wordpress-4-3-1/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"WordPress ›   WordPress 4.3.1 Security and Maintenance Release","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://wpvulndb.com/vulnerabilities/8186","name":"https://wpvulndb.com/vulnerabilities/8186","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"WordPress <= 4.3 - Authenticated Shortcode Tags Cross-Site Scripting (XSS)","mime":"text/html","httpstatus":"403","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5714","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5714","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"5714","vulnerable":"1","versionEndIncluding":"4.3.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wordpress","cpe5":"wordpress","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T06:59:04.355Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://wpvulndb.com/vulnerabilities/8186"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://codex.wordpress.org/Version_4.3.1"},{"name":"DSA-3375","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2015/dsa-3375"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/WordPress/WordPress/commit/f72b21af23da6b6d54208e5c1d65ececdaa109c8"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://wordpress.org/news/2015/09/wordpress-4-3-1/"},{"name":"1033979","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1033979"},{"name":"DSA-3383","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2015/dsa-3383"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://security-tracker.debian.org/tracker/CVE-2015-5714"},{"name":"76745","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/76745"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-09-15T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-11-03T18:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"https://wpvulndb.com/vulnerabilities/8186"},{"tags":["x_refsource_CONFIRM"],"url":"https://codex.wordpress.org/Version_4.3.1"},{"name":"DSA-3375","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2015/dsa-3375"},{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/WordPress/WordPress/commit/f72b21af23da6b6d54208e5c1d65ececdaa109c8"},{"tags":["x_refsource_CONFIRM"],"url":"https://wordpress.org/news/2015/09/wordpress-4-3-1/"},{"name":"1033979","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1033979"},{"name":"DSA-3383","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2015/dsa-3383"},{"tags":["x_refsource_CONFIRM"],"url":"https://security-tracker.debian.org/tracker/CVE-2015-5714"},{"name":"76745","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/76745"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2015-5714","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://wpvulndb.com/vulnerabilities/8186","refsource":"MISC","url":"https://wpvulndb.com/vulnerabilities/8186"},{"name":"https://codex.wordpress.org/Version_4.3.1","refsource":"CONFIRM","url":"https://codex.wordpress.org/Version_4.3.1"},{"name":"DSA-3375","refsource":"DEBIAN","url":"http://www.debian.org/security/2015/dsa-3375"},{"name":"https://github.com/WordPress/WordPress/commit/f72b21af23da6b6d54208e5c1d65ececdaa109c8","refsource":"CONFIRM","url":"https://github.com/WordPress/WordPress/commit/f72b21af23da6b6d54208e5c1d65ececdaa109c8"},{"name":"https://wordpress.org/news/2015/09/wordpress-4-3-1/","refsource":"CONFIRM","url":"https://wordpress.org/news/2015/09/wordpress-4-3-1/"},{"name":"1033979","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1033979"},{"name":"DSA-3383","refsource":"DEBIAN","url":"http://www.debian.org/security/2015/dsa-3383"},{"name":"https://security-tracker.debian.org/tracker/CVE-2015-5714","refsource":"CONFIRM","url":"https://security-tracker.debian.org/tracker/CVE-2015-5714"},{"name":"76745","refsource":"BID","url":"http://www.securityfocus.com/bid/76745"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2015-5714","datePublished":"2016-05-22T01:00:00.000Z","dateReserved":"2015-08-02T00:00:00.000Z","dateUpdated":"2024-08-06T06:59:04.355Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2016-05-22 01:59:01","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionEndIncluding":"4.3.0","matchCriteriaId":"398224EA-459C-49CF-9176-B144CA74A0F2"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"5714","Ordinal":"1","Title":"CVE-2015-5714","CVE":"CVE-2015-5714","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"5714","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.","Type":"Description","Title":"CVE-2015-5714"},{"CveYear":"2015","CveId":"5714","Ordinal":"2","NoteData":"2016-05-21","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"5714","Ordinal":"3","NoteData":"2017-11-03","Type":"Other","Title":"Modified"}]}}}