Any WordPress Plugin or theme that leverages the genericons package is vulnerable to a DOM-based Cross-Site Scripting (XSS) vulnerability due to an insecure file included with genericons. Any plugin that makes use of this package is potentially vulnerable if it includes the example.html file that comes with the package.
This vulnerability affects the following application versions:
- WordPress 4.0
- WordPress 4.0.1
- WordPress 4.0.2
- WordPress 4.0.3
- WordPress 4.0.4
- WordPress 4.0.5
- WordPress 4.0.6
- WordPress 4.0.7
- WordPress 4.0.8
- WordPress 4.0.9
- WordPress 4.0.10
- WordPress 4.0.11
- WordPress 4.0.12
- WordPress 4.0.13
- WordPress 4.0.14
- WordPress 4.0.15
- WordPress 4.0.16
- WordPress 4.0.17
- WordPress 4.0.18
- WordPress 4.0.19
- WordPress 4.0.20
- WordPress 4.0.21
- WordPress 4.0.22
- WordPress 4.0.23
- WordPress 4.0.24
- WordPress 4.0.25
- WordPress 4.0.26
- WordPress 4.0.27
- WordPress 4.0.28
- WordPress 4.0.29
- WordPress 4.0.30
- WordPress 4.0.31
- WordPress 4.0.32
- WordPress 4.0.33
- WordPress 4.0.34
- WordPress 4.0.35
- WordPress 4.0.36
- WordPress 4.0.37
- WordPress 4.0.38
- WordPress 4.1
- WordPress 4.1.1
- WordPress 4.1.2
- WordPress 4.1.3
- WordPress 4.1.4
- WordPress 4.2
- WordPress 4.2.1
- Genericons 3.0.3
- Genericons 3.1
- Jetpack 2.8
- Jetpack 2.8.3
- Jetpack 2.8.4
- Jetpack 2.8.5
- Jetpack 2.8b1
- Jetpack 2.9
- Jetpack 2.9.1
- Jetpack 2.9.1b1
- Jetpack 2.9.2
- Jetpack 2.9.3
- Jetpack 2.9.4
- Jetpack 2.9.5
- Jetpack 2.9.6
- Jetpack 2.9b1
- Jetpack 2.9b2
- Jetpack 2.9b3
- Jetpack 2.9b4
- Jetpack 3.0
- Jetpack 3.0.1
- Jetpack 3.0.2
- Jetpack 3.0.2b1
- Jetpack 3.0.2b2
- Jetpack 3.0.4
- Jetpack 3.0.5
- Jetpack 3.0.6
- Jetpack 3.1
- Jetpack 3.1.1
- Jetpack 3.1.3
- Jetpack 3.1.4
- Jetpack 3.1.5