Download WordPress 3.3.2

Version 3.3.2 of WordPress has been released. With this program, which is made available under the gpl license, it is possible to set up and maintain a weblog. WordPress is easy to set up and should be up and running in under five minutes if a server with PHP and MySQL is already available. There are possibilities to further extend the functionality of WordPress, in addition to blogging, and improve the appearance with plugins and themes to adjust.

New in version 3.3 includes the ability to easily add media via drag’n’drop, the menus now open when the mouse hovers over them and speech bubbles are shown with every update that introduce new features. Various bug and security fixes have been implemented in this second update.

Three external libraries included in WordPress received security updates:

• Plupload (version 1.5.4), which WordPress uses for uploading media.
• SWFUpload, which WordPress previously used for uploading media, and may still be in use by plugins.
• SWFObject, which WordPress previously used to embed Flash content, and may still be in use by plugins and themes.

thanks to Neal Poole and Nathan Partlan for responsibly disclosing the bugs in Plupload and SWFUpload, and Szymon Gruszeckic for a separate bug in SWFUpload.

WordPress 3.3.2 also addresses:

• Limited privilege escalation where a site administrator could deactivate network-wide plugins when running a WordPress network under particular circumstances, disclosed by Jon Cave of our WordPress core security team, and Adam Backstrom.
• Cross-site scripting vulnerability when making URLs clickable, by Jon Cave.
• Cross-site scripting vulnerabilities in redirects after posting comments in older browsers, and when filtering URLs. thanks to Mauro Gentile for responsibly disclosing these issues to the security team.

These issues were fixed by the WordPress core security team. Five other bugs were also fixed in version 3.3.2. Consult the change log for more details.