CVE-2015-3998: Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring p...

Security readout for executives and security teams

CVE-2015-3998 is a reported cross-site scripting issue in phpwhois 4.2.5, used by the adsense-click-fraud-monitoring WordPress plugin 1.7.5. An attacker could inject script or HTML through the whois.php query parameter. The source bundle does not provide CVSS, confirmed exploitation, or patch details. Likely exposure is WordPress sites running adsense-click-fraud-monitoring 1.7.5 with bundled phpwhois 4.2.5 and reachable whois.php functionality. The provided affected-product metadata is incomplete, so broader phpwhois exposure should be verified locally rather than assumed. Prioritize this for externally reachable WordPress sites using the named plugin, especially where administrators may interact with the affected page. Without severity scoring or active exploitation evidence, this is a targeted hygiene and exposure-reduction item rather than an emergency by default. Mitigation focus: Identify any use of adsense-click-fraud-monitoring 1.7.5 or phpwhois 4.2.5.; Check vendor or project guidance for a fixed version or official workaround.; Disable or remove exposed whois.php functionality if it is not required..

Prepared

Jun 13, 2026, 05:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.