CVE-2015-5622: Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inj...

Security readout for executives and security teams

CVE-2015-5622 is an authenticated cross-site scripting flaw in WordPress before 4.2.3. A user with Author or Contributor privileges could place a crafted shortcode inside HTML so script or HTML runs in another user’s browser. Business impact depends on whether old WordPress sites still exist and whether lower-privileged content authors are trusted. Exposure is most likely on legacy WordPress installations older than 4.2.3, especially sites allowing Author or Contributor accounts for staff, contractors, customers, or community users. Current, maintained WordPress deployments should be outside the described affected range, but old Debian-packaged WordPress instances also need package-level review. Treat this as a legacy hygiene and access-control priority, not an emergency based on the provided evidence. Prioritize any internet-facing WordPress site below 4.2.3, especially where non-admin users can publish or submit content. Mitigation focus: Upgrade WordPress core to 4.2.3 or a supported later release.; Apply relevant Debian security updates for packaged WordPress deployments.; Review and minimize Author and Contributor privileges on legacy sites..

Prepared

Jun 13, 2026, 22:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.