New WordPress Security Release Crosses Out XSS Vulnerabilities

On April 23, content management platform WordPress released an update to version 4.2. It followed up with a new WordPress security release (4.2.2), which became available May 7 and takes aim at two critical cross-site scripting (XSS) vulnerabilities. The company has advised anyone running 4.2 or a previous version to update immediately to reduce the risk of an XSS attack.

Two for One?

According to the official WordPress blog, version 4.2.2 addresses two separate issues with similar attack vectors. The first stems from the Genericons icon font package, which is incorporated in many themes and site plugins, including the default “Twenty Fifteen” WordPress theme. This icon package, however, contains a nonessential HTML file that can be used to stage an XSS attack.

PCWorld noted that researchers from Sucuri have already seen strikes using this vulnerability, which requires attackers to create special links and then convince WordPress users to click. If they’re lucky, and the victim is a website admin, it’s possible for malicious actors to gain control over the entire site. To solve the problem, users can either remove the “example.html” file from Genericons or update to the 4.2.2 WordPress security release, which proactively scans for and deletes the file.

There’s also another, broader problem that affects all WordPress versions 4.2 and earlier: As reported by Rice Adu and Tong Shi from Baidu, according to the WordPress blog, this vulnerability made it possible for anonymous attackers to compromise victims’ websites. The security release 4.2.2 is supposed to provide a “comprehensive fix” for this issue.

Don’t Be Cross

This isn’t the first time WordPress has addressed critical vulnerabilities — no surprise, since more than 20 percent of the Web is powered by the CMS. In 2014, for example, Mashable reported on an XML exploit for version 3.9, which used the Quadratic Blowup Attack and could render a website or service useless by forcing 100 percent CPU and RAM usage. Using a tiny XML document, attackers gained the ability to bring down a host of WordPress and Drupal websites.

It’s also not the first XSS problem for WordPress, but unlike the XML attack, the most recent XSS issue came just over two weeks ago. On April 21, the company pushed out version 4.1.2, calling it a critical security release and advising that “WordPress versions 4.1.1 and earlier are affected by a critical cross-site vulnerability, which could enable anonymous users to compromise a site.” Interestingly, that’s the exact same wording on the new WordPress security release, save for the fact that versions 4.2 and earlier are affected. Presumably this was the same issue now addressed by 4.2.2. Hopefully, this time it’s gone for good.

Got WordPress? Then get version 4.2.2, and avoid the double-cross.

Douglas Bonderud

Freelance Writer

Cybersecurity dominates concerns among the C-suite, small businesses and the nation

4 min read - Once relegated to the fringes of business operations, cybersecurity has evolved into a front-and-center concern for organizations worldwide. What was once considered a technical issue managed by IT departments has become a boardroom topic of utmost importance. With the rise of sophisticated cyberattacks, the growing use of generative AI by threat actors and massive data breach costs, it is no longer a question of whether cybersecurity matters but how deeply it affects every facet of modern operations.The 2024 Allianz Risk…

Autonomous security for cloud in AWS: Harnessing the power of AI for a secure future

3 min read - As the digital world evolves, businesses increasingly rely on cloud solutions to store data, run operations and manage applications. However, with this growth comes the challenge of ensuring that cloud environments remain secure and compliant with ever-changing regulations. This is where the idea of autonomous security for cloud (ASC) comes into play.Security and compliance aren't just technical buzzwords; they are crucial for businesses of all sizes. With data breaches and cyber threats on the rise, having systems that ensure your…

Adversarial advantage: Using nation-state threat analysis to strengthen U.S. cybersecurity

4 min read - Nation-state adversaries are changing their approach, pivoting from data destruction to prioritizing stealth and espionage. According to the Microsoft 2023 Digital Defense Report, "nation-state attackers are increasing their investments and launching more sophisticated cyberattacks to evade detection and achieve strategic priorities."These actors pose a critical threat to United States infrastructure and protected data, and compromising either resource could put citizens at risk.Thankfully, there's an upside to these malicious efforts: information. By analyzing nation-state tactics, government agencies and private enterprises are…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Two for One?

Don’t Be Cross

More from

Cybersecurity dominates concerns among the C-suite, small businesses and the nation

Autonomous security for cloud in AWS: Harnessing the power of AI for a secure future

Adversarial advantage: Using nation-state threat analysis to strengthen U.S. cybersecurity

Topic updates