[spocked]

https://wordpress.org/news/2015/05/wordpress-4-2-2/

This is a critical security release. The cross-site scripting vulnerability lets a commenter compromise your website.

[ghubbard]

The exploit is described and demonstrated in a video on the site of the discoverer: http://klikki.fi/adv/wordpress2.html