Theres a new vulnerability with WordPress.
The vulnerability was discovered by Jouko Pynn√∂nen of Klikki Oy.
Wordpress Team has released a update to solve it.
Update your WordPress immediately!
If your WordPress site allows users to post comments via the WordPress commenting system, you‚Äôre at risk. An attacker could leverage a bug in the way comments are stored in the site‚Äôs database to insert malicious scripts on your site, thus potentially allowing them¬†to infect your visitors with malware, inject SEO spam or even insert backdoor in the site‚Äôs code if the code runs when in a logged-in administrator browser.
Read more at https://blog.sucuri.net/2015/04/critical-persistent-xss-0day-in-wordpress.html
*Virtually* everyone is vulnerable!
Backup your WordPress and update your plugins and eventually even your themes now!
Multiple WordPress Plugins are vulnerable to Cross-site Scripting (XSS) due to the misuse of the add_query_arg() and remove_query_arg() functions. These are popular functions used by developers to modify and add query strings to URLs within WordPress.
The official WordPress Official Documentation (Codex) for these functions was not very clear and misled many plugin developers to use them in an insecure way. The developers assumed that these functions would escape the user input for them, when it does not. This simple detail, caused many of the most popular plugins to be vulnerable to XSS.
Some affected plugins:
- WordPress SEO
- Google Analytics by Yoast
- All In One SEO
- Gravity Forms
- Multiple Plugins from Easy Digital Downloads
- Download Monitor
- Related Posts for WordPress
- My Calendar
- P3 Profiler
- Multiple iThemes products including Builder and Exchange
- Ninja Forms
You MUST update this plugins since they have been patched this morning!
Rea more on¬†https://blog.sucuri.net/2015/04/secu…s-plugins.html
A¬†security researcher from Salesforce.com‚Äôs product security team, Nir Goldshlager (Twitter, blog), has discovered an XML vulnerability that impacts the popular website platforms WordPress and Drupal.
We strongly encourage you to update your WordPress installations¬†immediately.
Continue reading Important security breach on WordPress and Drupal
Useful and related articles with StagCMS