Persistent XSS 0day in WordPress

Theres a new vulnerability with WordPress.
The vulnerability was discovered by Jouko Pynnönen of Klikki Oy.
Wordpress Team has released a update to solve it.
Update your WordPress immediately!

 

Who’s affected

If your WordPress site allows users to post comments via the WordPress commenting system, you’re at risk. An attacker could leverage a bug in the way comments are stored in the site’s database to insert malicious scripts on your site, thus potentially allowing them to infect your visitors with malware, inject SEO spam or even insert backdoor in the site’s code if the code runs when in a logged-in administrator browser.

Read more at https://blog.sucuri.net/2015/04/critical-persistent-xss-0day-in-wordpress.html

 

XSS Vulnerability Affecting Multiple WordPress Plugins

*Virtually* everyone is vulnerable!
Backup your WordPress and update your plugins and eventually even your themes now!
Multiple WordPress Plugins are vulnerable to Cross-site Scripting (XSS) due to the misuse of the add_query_arg() and remove_query_arg() functions. These are popular functions used by developers to modify and add query strings to URLs within WordPress.
The official WordPress Official Documentation (Codex) for these functions was not very clear and misled many plugin developers to use them in an insecure way. The developers assumed that these functions would escape the user input for them, when it does not. This simple detail, caused many of the most popular plugins to be vulnerable to XSS.
Some affected plugins:
  • Jetpack
  • WordPress SEO
  • Google Analytics by Yoast
  • All In One SEO
  • Gravity Forms
  • Multiple Plugins from Easy Digital Downloads
  • UpdraftPlus
  • WP-E-Commerce
  • WPTouch
  • Download Monitor
  • Related Posts for WordPress
  • My Calendar
  • P3 Profiler
  • Give
  • Multiple iThemes products including Builder and Exchange
  • Broken-Link-Checker
  • Ninja Forms

You MUST update this plugins since they have been patched this morning!

Rea more on¬†https://blog.sucuri.net/2015/04/secu…s-plugins.html

 

WP-Super-Cache security vulnerability

Since lot of people is using WP-Super-Cache, we would like to advise our clients that WP-Super-Cache has a recent discovered vulnerability.

WP Super Cache, a WordPress plugin, contains a persistent XSS vulnerability in versions prior to 1.4.4. Exploitation of this vulnerability could allow a remote attacker to take control of the affected system.

Users and administrators are encouraged to review the WP Super Cache Changelog for more information and update to version 1.4.4 if affected.

In https://www.us-cert.gov/ncas/current-activity/2015/04/09/WP-Super-Cache-Cross-Site-Scripting-XSS-Vulnerability

 

Security Risk: Dangerous
Exploitation level: Very Easy/Remote
DREAD Score: 8/10
Vulnerability: Persistent XSS
Patched Version:  1.4.4

In https://blog.sucuri.net/2015/04/security-advisory-persistent-xss-in-wp-super-cache.html