More than a million WordPress installations susceptible to plugin xss vulnerability

A security company recently found an xss vulnerability in WordPress during a routine check. The vulnerability allows attackers to inject and execute malicious code. More than a million active installations are potentially susceptible.

Security firm Sucuri said it was conducting a routine audit when it discovered a “dangerous” xss leak in the popular WordPress plugin WP-Super-Cache. With the plugin, php scripts from WordPress can be converted into static HTML files, which makes it faster to serve the website.

The vulnerability allows attackers to execute malicious code. According to Sucuri, this allows them to obtain admin rights from the site, install backdoors and more, among other things. According to WordPress.org, there are over a million active installations with WP-Super-Cache. In the latest version of the plugin, 1.4.4, the vulnerability has been fixed.

WordPress is a popular cms that website administrators use worldwide. Vulnerabilities regularly appear in the system, often also the result of plugins that are not completely watertight. It was recently revealed that at least three thousand websites are serving malware to users through a plugin that suffered from a security problem.