CVE-2015-5622: Debian Linux

Low severity, CVSS 3.5. EPSS: 4.9% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.

Affected products

• Debian Debian Linux: version 8.0 only
• WordPress WordPress: up to and including 4.2.2

Published 2015-08-03. Last modified 2026-06-17.