What is CVE-2015-9358?

CVE-2015-9358 is tracked as a Cross-Site Scripting issue affecting the Plugin FeedWordPress.

Which FeedWordPress versions are affected?

The primary affected range is Versions before 2015.0514.

How should operators remediate CVE-2015-9358?

Update to 2015.0514 or newer where that release is compatible with the site.

Vulnerability Report

Plugin Medium Patch path listed CVE-2015-9358

FeedWordPress < 2015.0514 - Reflected Cross-Site Scripting

The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().

Quick Answer

CVE-2015-9358 is a medium severity with CVSS 6.1 Cross-Site Scripting issue affecting the Plugin FeedWordPress. It affects Versions before 2015.0514 and is fixed in 2015.0514.

Back to Feed View Plugin Hub Open CVE Reference

Published

May 14, 2015

Last Updated

Jan 22, 2024

Slug

feedwordpress

Risk Profile

6.1 CVSS Score

Weakness

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Researchers

quassy

Operational Summary

What the operator needs to know

Share Email

Patch Status

Patched release is available

Remediation

Update to version 2015.0514, or a newer patched version

Operator Briefing

CVE-2015-9358 is tracked for the Plugin FeedWordPress as medium severity with CVSS 6.1. The affected range is Versions before 2015.0514. Update FeedWordPress to 2015.0514 or newer where that version is compatible with the site.

Issue Type

Cross-Site Scripting

Primary Fixed Version

2015.0514

Primary Affected Range

Versions before 2015.0514

Tracking ID

CVE-2015-9358

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/108a2ea3-a612-46a2-b29a-7ae794f8470c?source=api-prod

Detailed Metadata

Software Type	Plugin
Software Slug	feedwordpress View on wordpress.org
CVE	CVE-2015-9358
Patched Versions	2015.0514
Affected Versions	Versions before 2015.0514

Related CVE Cluster

Related CVEs for FeedWordPress

These internal links group the same WordPress plugin by CVE, issue type, severity, and patch status so operators and search engines can connect the full vulnerability cluster.

Critical CVE-2015-4018 2015.0514 May 19, 2015

CVE-2015-4018 FeedWordPress SQL Injection

FeedWordPress < 2015.0514 - SQL Injection

Medium CVE-2021-25055 2022.0123 Jan 18, 2022

CVE-2021-25055 FeedWordPress Cross-Site Scripting

FeedWordPress <= 2021.0713 - Reflected Cross-Site Scripting

Medium CVE-2024-0839 2024.0428 Mar 04, 2024

CVE-2024-0839 FeedWordPress Authorization Bypass

FeedWordPress <= 2022.0222 - Insecure Direct Object Referece

Medium 2015.0426 Apr 26, 2015

FeedWordPress Cross-Site Scripting

FeedWordPress < 2015.0426 - Cross-Site Scripting

Licensing Notices

This record contains material that is subject to copyright

DEFIANT

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more

MITRE

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more