Incident Response, Network Security, Patch/Configuration Management, TDR, Vulnerability Management

Jetpack plug-in for WordPress vulnerable to XSS

Bloggers using the WordPress platform are being advised to update the Jetpack plug-in to avoid a cross-site scripting vulnerability.

One million users of the plug-in – which was developed by Automattic, the makers of WordPress – could be at risk. The tool provides website enhancements, management and security features.

The flaw – which impacts Jetpack releases since 2012, beginning with v2.0 – was detected by web security firm Sucuri. The bug is located in the Shortcode Embeds Jetpack module, a shortcut function enabled by default that allows users to embed videos, images, documents, tweets and other materials. 

The Sucuri researchers said this flaw can be exploited to inject malicious JavaScript code into comments. Subsequently, it "could allow an attacker to hijack administrator accounts, inject SEO spam to the affected page, and redirect visitors to malicious websites," Sucuri noted in a blog post.

Update as soon as possible, said the researchers.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.