Home WordPress Issues Critical Update

WordPress Issues Critical Update

WordPress has detected and fixed a cross-site scripting (XSS) vulnerability. WordPress 3.04 contains the fix that founder Matt Mullenweg calls “critical.” Hosted WordPress.com customers don’t need to worry, as security updates happen automatically for them.

XSS attacks can be used to steal login information or other sensitive information from visitors to a particular site. According to ReadWriteWeb staff hacker Tyler Gilles, this is similar to XSS vulnerability that affected Twitter users recently. He notes that WordPress’s fix is similar to Twitter’s.

The vulnerability was found in KSES, WordPress’s HTML sanitation library. WordPress was first notified of the issue by Mauro Gentile and Jon Cave.

Mullenweg writes that although the WordPress team has given the update “a lot of thought and review” it would like to have the update reviewed by as many security researchers as possible and invites everyone to look at the changeset.

Developers wanting to avoid XSS vulnerabilities in their own projects may wish to check out XSS (Cross Site Scripting) Prevention Cheat Sheet from The Open Web Application Security Project (OWASP). According to OWASP, XSS is the second most common security vulnerability on the web.

About ReadWrite’s Editorial Process

The ReadWrite Editorial policy involves closely monitoring the tech industry for major developments, new product launches, AI breakthroughs, video game releases and other newsworthy events. Editors assign relevant stories to staff writers or freelance contributors with expertise in each particular topic area. Before publication, articles go through a rigorous round of editing for accuracy, clarity, and to ensure adherence to ReadWrite's style guidelines.

Get the biggest tech headlines of the day delivered to your inbox

    By signing up, you agree to our Terms and Privacy Policy. Unsubscribe anytime.

    Tech News

    Explore the latest in tech with our Tech News. We cut through the noise for concise, relevant updates, keeping you informed about the rapidly evolving tech landscape with curated content that separates signal from noise.

    In-Depth Tech Stories

    Explore tech impact in In-Depth Stories. Narrative data journalism offers comprehensive analyses, revealing stories behind data. Understand industry trends for a deeper perspective on tech's intricate relationships with society.

    Expert Reviews

    Empower decisions with Expert Reviews, merging industry expertise and insightful analysis. Delve into tech intricacies, get the best deals, and stay ahead with our trustworthy guide to navigating the ever-changing tech market.