WordPress 5.4.2 release announcement stated the update shipped with multiple fixes for Cross-Site Scripting (XSS) vulnerabilities. Out of this the most significant fix is the one resolving, “an XSS issue where authenticated users with low privileges are able to add JavaScript to posts in the block editor.”
Sam Thomas (jazzy2fives) has been credited with discovery of this particular XSS vulnerability.
Starting in versions 5.x, WordPress introduced a “block editor” which attempts to mimic modern editor, as offered by sites like Medium. The editor with its sleek design appears to be more lightweight than its predecessor Classic Editor that has shipped with WordPress versions.
The XSS flaw in this newer editor meant that authenticated users with even the lowest level of access to the editor, such as contributors, could inject malicious JavaScript in a post. The post when loaded by the user would execute seamlessly and cause Cross-Site Scripting (XSS) attacks.
Unlike WordPress vulns. we hear about these days which impact various plugins, this one is in the Core platform itself, prompting an urgent need for users to patch their installations!
The advisory additionally mentions other security updates along with crediting those who reported these vulnerabilities:
WordPress versions 5.4 and earlier are affected by the following bugs, which are fixed in version 5.4.2. If you haven’t yet updated to 5.4, there are also updated versions of 5.3 and earlier that fix the security issues.
Users are advised to update their WordPress installations. Should automatic updates be not enabled, WordPress 5.4.2 can be downloaded by navigating to your website’s Admin Dashboard and navigating to Updates → Update Now.
Telecommunication, media, internet service providers (ISPs), information technology (IT)-service providers, and Kurdish websites in the…
Rogue WordPress Plugin Found to Steal Credit Card Information in Magecart Campaign Threat hunters have…
The Assembly of the Republic of Albania and telecom company One Albania have recently fallen…
The banking malware Carbanak has resurfaced with updated tactics, incorporating attack vendors and techniques to…
One of the world's largest theme park operators, Parques Reunidos has disclosed a cybersecurity incident.…
Phishing kit used by multiple hacked sites generates a log in page on the fly…
This website uses cookies.