ASEOHosting has cautioned for XSS Vulnerability
In Dozens Of WordPress Plugins for WordPress Users
ASEOHosting has given warning to WordPress users to update outdated plugins. Vulnerability which is discovered recently is capable to allow Cross Site Scripting attacks found in at least dozens of WordPress plugins including Jetpack, Yoast’s WordPress SEO plug-in, Easy Digital Downloads and Gravity Forms.
Joost de Valk which is the creator of WordPress SEO plugin, has firstly reported vulnerability. Misuse of two WordPress functions results in vulnerability. These functions has certification which attract developers to consider that created URL’s would be free ,which allow hacker to store malicious code into installation of WordPress. After URL lining with malicious code and embedded into the web page, users who are logged in could be entered by clicking on the link. As a result, code will run on a WordPress site.
The difficulty of this vulnerability is to upgrade all outdated plug-ins. Most of the cases have problems regarding WordPress automatic upgrades, but several developers including Joost de Valk have decided that updates cannot be applied automatically and users of WordPress will have possibility of deactivated automatic updates. Best possible way is immediately apply all outstanding WordPress plug-in.