CVE-2015-7357

MEDIUM 6.1CVE-2015-7357 · Published 03/10/2017 · updated 17/06/2026

In short

CVE-2015-7357 is a MEDIUM (CVSS 6.1) vulnerability affecting udesign (udesign project).
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
udesign udesign_project	`= 2.3.0= 2.3.1= 2.4.0= 2.4.1= 2.4.10= 2.4.11= 2.4.12= 2.4.13= 2.4.14= 2.4.15= 2.4.16= 2.4.17= 2.4.18= 2.4.19= 2.4.2= 2.4.3= 2.4.4= 2.4.5= 2.4.6= 2.4.7= 2.4.8= 2.4.9= 2.5.0= 2.5.1= 2.5.2= 2.5.3= 2.5.4= 2.5.5= 2.5.6= 2.6.0= 2.7.0= 2.7.1= 2.7.2= 2.7.3= 2.7.4= 2.7.5= 2.7.6= 2.7.7= 2.7.8= 2.7.9`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #<svg onload=alert(1)>.

References

packetstormsecurity.com/files/133867/WordPress-U-Design-Theme-2.7.9-Cross-Site-Scripting.html · Third Party Advisory
seclists.org/fulldisclosure/2015/Oct/25 · Mailing List
themeforest.net/item/udesign-responsive-wordpress-theme/253220 · Third Party Advisory
wpvulndb.com/vulnerabilities/8177 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free