CVE-2015-3440: Debian Linux

Medium severity, CVSS 4.3. EPSS: 16.9% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.

Affected products

• Debian Debian Linux: version 7.0 only; version 8.0 only
• WordPress WordPress: up to and including 4.2

Published 2015-08-03. Last modified 2026-06-17.