Security Blog
Security Blog
Posted By Gregory

WordPress 5.4.1. A security update fixes seven XSS vulnerabilities


Here we go. Multiple serious security issues affect WordPress versions 5.4 and earlier. Those issues include seven XSS vulnerabilities that exist for years in the WordPress core.

Because this is a security release, it is recommended that you update your websites immediately. Along with a security plugin you have.

Here is the list of fixed vulnerabilities as they listed on wordpress.org.

  • Props to Muaz Bin Abdus Sattar and Jannes who both independently reported an issue where password reset tokens were not properly invalidated
  • Props to ka1n4t for finding an issue where certain private posts can be viewed unauthenticated
  • Props to Evan Ricafort for discovering an XSS issue in the Customizer
  • Props to Ben Bidner from the WordPress Security Team who discovered an XSS issue in the search block
  • Props to Nick Daugherty from WordPress VIP / WordPress Security Team who discovered an XSS issue in wp-object-cache
  • Props to Ronnie Goodrich (Kahoots) and Jason Medeiros who independently reported an XSS issue in file uploads.
  • Props to Weston Ruter for fixing a stored XSS vulnerability in the WordPress customizer.

The source: https://wordpress.org/news/2020/04/wordpress-5-4-1/


I'm a team lead in Cerber Tech. I'm a software & database architect, WordPress - PHP - SQL - JavaScript developer. I started coding in 1993 on IBM System/370 (yeah, that was amazing days) and today software engineering at Cerber Tech is how I make my living. I've taught to have high standards for myself as well as using them in developing software solutions.

View Comments
There are currently no comments.