Description
"Genericons are vector icons embedded in a webfont designed to be clean and simple keeping with a generic aesthetic."
The Genericons package includes a file called example.html which has been found to be vulnerable to a DOM-based XSS vulnerability. This package is included in various WordPress plugins and themes. For example is included in the TwentyFifteen theme (installed by default) and the very popular JetPack plugin.
Remediation
Remove the example.html file located in the genericons directory.
References
WordPress 4.2.2 Security and Maintenance Release
Related Vulnerabilities
WordPress Plugin WordPress Custom Settings Cross-Site Scripting (1.0)
WordPress Plugin CM Ad Changer Cross-Site Scripting (1.7.7)
WordPress Plugin Slimstat Analytics Cross-Site Scripting (4.1.5.2)
WordPress Plugin Login with Azure (Azure SSO) Cross-Site Scripting (1.4.4)
WordPress Plugin IMPress Listings Cross-Site Scripting (2.0.1)