[paulojunior85]

The problem affects the theme TwentyFifteen, installed by default, and the Jetpack plugin, which has more than one million installations.
In focus is the package "genericons" WordPress, something that WordPress add-ons use and comes with an unsafe file, leaving the site open to cross-site scripting vulnerabilities. If a hacker get deceive a user and do you click on a malicious link, he can acquire full control of said user site.

Fortunately, the fix for the problem is simple: just remove the file "example.html" genericons of any instance in your WordPress.

how do you know this?

I have a friend that knows a lot about computer, wordpress and many things and one day he said about this.

[nejnej25]

This is something new to me. Thanks for this. I will remember this. Thumbs up.

[salah29]

Wow ; that's strang ,
Wordpress are send new update to fix this bug ;

[loudawg]

WordPress will always have its holes sadly due to how popular it is. I can't stress enough tho how important it is to make sure wordpress and its plugins are always updated! Many of the old versions are still used with flaws allowing easy access.

[ruben718]

I prefer wordpress with vulnerable or not, already installed a patch that corrects this mistake! But I will use new tools identical to the web such as drupal, joomla, etc.

[thisnthat]

My wordpress gets updated automatically. My plug ins don't. I guess that's something that I need to be more mindful of. I heard about the vulnerabilities recently. I then noticed that (one of my) plugins had prevented malicious log ins. I never had issues with malicious logins before this.

[LShun]

I agree, that's the reason most people head for the .com version because its less technical and require less maintenance.

[frankydoodle]

The wordpress website should take action on this. Many bloggers and even online earners are at risk of this security vulnerability. Security is really an illusion these days. Let us always be cautious and careful with the websites we are using.

[walash]

My side project blog was hacked through this. They actually injected some malwares into my files and my page got blacklisted... this sucks.

[fab]

is good to know , I used the wp a long time , and I was wanting to open a new blog , I'll be on it

[ripadas]

I never had problems with wordpress CMS and only become vulnerable if we want to ...

[Allius]

I'm glad you put this information here. It's just that I was considering creating my website / blog with wordpress ... I think I gave up to consider it!

[Hugop]

Thanks for the sharing, I will update my wordpress sites made in 2011

[sakithanavod]

That's worst thing that can happen to a blogger! If you are using a free wordpress blog it always can happen.Because, you can't use any protection plugin to secure site if you are using free wordpress blog.

[fabiof00]

Thanks for finding this issue and warning us!

A question though:
Has it been considered to fix this in the functions mentioned themselves?
If you would filter the input within the functions, then all plugins would be safe with the update of WP without the need to fix each plugin individually.
An argument as to that it would cost too much resources doesn't hold as the filter has to be executed nonetheless.

Any remarks?

[silverleafy]

for me wordpress wotked pretty fine until now

[kat82]

There is the trick I use on my WordPress. I use a fake nickname where all hackers will miss it since it's known only to me unless someone accesses my FTP. If you use known login names like admin, etc, chances are that your site will be exploited by hackers intending to do whatever they want.

[mrki444]

There is less vuneralbilites in Wordpress than in Wordpress plugins. Plugins are often hackers target. Latest big, popular plugin with zero day vunerability was Ultimate Member. One the most popular plugins for user managment.

[Mika]

I never have had any issues with wordpress. If you implement things like, using light weight themes, limiting plugin usage and using SSL, wordpress is perfect