WordPress 4.2.3 and earlier are vulnerable to a XSS vulnerability through broken links on the legacy theme preview.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5734
https://core.trac.wordpress.org/changeset/33549
This vulnerability affects the following application versions:
- WordPress 3.7
- WordPress 3.7.1
- WordPress 3.7.2
- WordPress 3.7.3
- WordPress 3.7.4
- WordPress 3.7.5
- WordPress 3.7.6
- WordPress 3.7.7
- WordPress 3.7.8
- WordPress 3.7.9
- WordPress 3.8
- WordPress 3.8.1
- WordPress 3.8.2
- WordPress 3.8.3
- WordPress 3.8.4
- WordPress 3.8.5
- WordPress 3.8.6
- WordPress 3.8.7
- WordPress 3.8.8
- WordPress 3.8.9
- WordPress 3.9
- WordPress 3.9.1
- WordPress 3.9.2
- WordPress 3.9.3
- WordPress 3.9.4
- WordPress 3.9.5
- WordPress 3.9.6
- WordPress 3.9.7
- WordPress 4.0
- WordPress 4.0.1
- WordPress 4.0.2
- WordPress 4.0.3
- WordPress 4.0.4
- WordPress 4.0.5
- WordPress 4.0.6
- WordPress 4.1
- WordPress 4.1.1
- WordPress 4.1.2
- WordPress 4.1.3
- WordPress 4.1.4
- WordPress 4.1.5
- WordPress 4.1.6
- WordPress 4.2
- WordPress 4.2.1
- WordPress 4.2.2
- WordPress 4.2.3