On April 23, content management platform WordPress released an update to version 4.2. It followed up with a new WordPress security release (4.2.2), which became available May 7 and takes aim at two critical cross-site scripting (XSS) vulnerabilities. The company has advised anyone running 4.2 or a previous version to update immediately to reduce the risk of an XSS attack.

Two for One?

According to the official WordPress blog, version 4.2.2 addresses two separate issues with similar attack vectors. The first stems from the Genericons icon font package, which is incorporated in many themes and site plugins, including the default “Twenty Fifteen” WordPress theme. This icon package, however, contains a nonessential HTML file that can be used to stage an XSS attack.

PCWorld noted that researchers from Sucuri have already seen strikes using this vulnerability, which requires attackers to create special links and then convince WordPress users to click. If they’re lucky, and the victim is a website admin, it’s possible for malicious actors to gain control over the entire site. To solve the problem, users can either remove the “example.html” file from Genericons or update to the 4.2.2 WordPress security release, which proactively scans for and deletes the file.

There’s also another, broader problem that affects all WordPress versions 4.2 and earlier: As reported by Rice Adu and Tong Shi from Baidu, according to the WordPress blog, this vulnerability made it possible for anonymous attackers to compromise victims’ websites. The security release 4.2.2 is supposed to provide a “comprehensive fix” for this issue.

Don’t Be Cross

This isn’t the first time WordPress has addressed critical vulnerabilities — no surprise, since more than 20 percent of the Web is powered by the CMS. In 2014, for example, Mashable reported on an XML exploit for version 3.9, which used the Quadratic Blowup Attack and could render a website or service useless by forcing 100 percent CPU and RAM usage. Using a tiny XML document, attackers gained the ability to bring down a host of WordPress and Drupal websites.

It’s also not the first XSS problem for WordPress, but unlike the XML attack, the most recent XSS issue came just over two weeks ago. On April 21, the company pushed out version 4.1.2, calling it a critical security release and advising that “WordPress versions 4.1.1 and earlier are affected by a critical cross-site vulnerability, which could enable anonymous users to compromise a site.” Interestingly, that’s the exact same wording on the new WordPress security release, save for the fact that versions 4.2 and earlier are affected. Presumably this was the same issue now addressed by 4.2.2. Hopefully, this time it’s gone for good.

Got WordPress? Then get version 4.2.2, and avoid the double-cross.