WordPress Vulnerability

This is a new, serious wordpress vulnerability, announced recently which has the potential to cause some damage and disruption. Current versions of WordPress are vulnerable to a stored XSS. An unauthenticated attacker can inject JavaScript in WordPress comments. The script is triggered when the comment is viewed.

WordPress Vulnerability Impact:

If triggered by a logged-in administrator, under default settings the attacker can leverage the vulnerability to execute arbitrary code on the server via the plugin and theme editors.

Alternatively the attacker could change the administrator’s password, create new administrator accounts, or do whatever else the currently logged-in administrator can do on the target system. You can find more details about the impact and solution for the same by clicking here.

Steps you need to take:

The firm WordPress on Thursday released version 4.2.2 update which is basically a security and maintenance release targeted to fix the wordpress vulnerability. The latest release addresses two security issues including updated genericons used in default themes and plugins that scan the WordPress content directory for the affected (and “nonessential”) example.html file and removes it. So we would request you to go update the WordPress to version 4.2.2 to fix the wordpress vulnerability.

Warm Regards,

Team J. J. Infosys
http://www.jjinfosys.com
http://reseller.jjinfosys.com

 

Tagged with:

Filed under: Announcements

Like this post? Subscribe to my RSS feed and get loads more!