Category Archives: Security

Persistent XSS 0day in WordPress

Theres a new vulnerability with WordPress.
The vulnerability was discovered by Jouko Pynnönen of Klikki Oy.
Wordpress Team has released a update to solve it.
Update your WordPress immediately!

 

Who’s affected

If your WordPress site allows users to post comments via the WordPress commenting system, you’re at risk. An attacker could leverage a bug in the way comments are stored in the site’s database to insert malicious scripts on your site, thus potentially allowing them to infect your visitors with malware, inject SEO spam or even insert backdoor in the site’s code if the code runs when in a logged-in administrator browser.

Read more at https://blog.sucuri.net/2015/04/critical-persistent-xss-0day-in-wordpress.html

 

XSS Vulnerability Affecting Multiple WordPress Plugins

*Virtually* everyone is vulnerable!
Backup your WordPress and update your plugins and eventually even your themes now!
Multiple WordPress Plugins are vulnerable to Cross-site Scripting (XSS) due to the misuse of the add_query_arg() and remove_query_arg() functions. These are popular functions used by developers to modify and add query strings to URLs within WordPress.
The official WordPress Official Documentation (Codex) for these functions was not very clear and misled many plugin developers to use them in an insecure way. The developers assumed that these functions would escape the user input for them, when it does not. This simple detail, caused many of the most popular plugins to be vulnerable to XSS.
Some affected plugins:
  • Jetpack
  • WordPress SEO
  • Google Analytics by Yoast
  • All In One SEO
  • Gravity Forms
  • Multiple Plugins from Easy Digital Downloads
  • UpdraftPlus
  • WP-E-Commerce
  • WPTouch
  • Download Monitor
  • Related Posts for WordPress
  • My Calendar
  • P3 Profiler
  • Give
  • Multiple iThemes products including Builder and Exchange
  • Broken-Link-Checker
  • Ninja Forms

You MUST update this plugins since they have been patched this morning!

Rea more on¬†https://blog.sucuri.net/2015/04/secu…s-plugins.html

 

Important security breach on WordPress and Drupal

A security researcher from Salesforce.com’s product security team, Nir Goldshlager (Twitter, blog), has discovered an XML vulnerability that impacts the popular website platforms WordPress and Drupal.

We strongly encourage you to update your WordPress installations immediately.

Continue reading Important security breach on WordPress and Drupal