Home » Technology and Apps » Flaw in popular WordPress plug-in Jetpack puts over a million websites at risk

Flaw in popular WordPress plug-in Jetpack puts over a million websites at risk

Owners of WordPress-based websites should update the Jetpack plug-in as soon as possible because of a serious flaw that could expose their users to attacks.

Jetpack is a popular plug-in that offers free website optimization, management and security features. It was developed by Automattic, the company behind WordPress.com and the WordPress open-source project, and has over 1 million active installations.

Wordpress-logo-

Researchers from Web security firm Sucuri have found a stored cross-site scripting (XSS) vulnerability that affects all Jetpack releases since 2012, starting with version 2.0.

The issue is located in the Shortcode Embeds Jetpack module which allows users to embed external videos, images, documents, tweets and other resources into their content. It can be easily exploited to inject malicious JavaScript code into comments.

Related Post: 20 Tips For A Secure WordPress Website

Since the JavaScript code is persistent, it will get executed in users’ browsers in the context of the affected website every time they view the malicious comment. This can be used to steal their authentication cookies, including the administrator’s session; to redirect visitors to exploits, or to inject search engine optimization (SEO) spam.

“The vulnerability can be easily exploited via wp-comments and we recommend everyone to update asap, if you have not done so yet,” said Sucuri researcher Marc-Alexandre Montpas in a blog post.

Sites that don’t have the Shortcode Embeds module activated are not affected, but this module provides popular functionality so many websites are likely to have it enabled.

The Jetpack developers have worked with the WordPress security team to push updates to all affected versions through the WordPress core auto-update system.Jetpack versions 4.0.3 or newer contain the fix.

In case users don’t want to upgrade to the latest version, the Jetpack developers have also released point releases for all twenty-one vulnerable branches of the Jetpack codebase: 2.0.7, 2.1.5, 2.2.8, 2.3.8, 2.4.5, 2.5.3, 2.6.4, 2.7.3, 2.8.3, 2.9.4, 3.0.4, 3.1.3, 3.2.3, 3.3.4, 3.4.4, 3.5.4, 3.6.2, 3.7.3, 3.8.3, 3.9.7, and 4.0.3.

Source: PCWorld

 

Looking for secure WordPress development services? ValueCoders provides secure WordPress development services with the following advantages. 

  1. Flexible Hiring Models
  2. Expert Teams
  3. Guaranteed SLAs
Are you ready to turn your idea into reality? Contact Us Now

More From ValueCoders Blogs:-

AngularJS-vs-ReactJS detailed

AngularJS vs ReactJS : What’s good for your business?

AngularJS is managed by Google and ReactJS is owned by Facebook. Both of them are unique and resourceful in their own ways. These frameworks are quite easy to use with […] - Read More

Agile Methodology cover

7 best practices of scrum in agile methodology

When most of the people think of Agile methodology, they think of “Scrum”.  Before proceeding, let us clear first what scrum stands for. Scrum is the most widely used, […] - Read More

PHP-vs-Node.js

PHP or NodeJS: which is more secure?

From the beginning, PHP has always been there to take it to the next level. However, with the advancements in technologies, PHP apps are becoming a primary target to […] - Read More

Security Tips For Your WordPress Site [Infographic]

Security Tips For Your WordPress Site [Infographic]

WordPress is one of the most popular and powerful CMS ifor business websites and blogs. Keeping your WordPress site secure from malware is important for every business. […] - Read More

  • Mehdi Koundi

    I recommend installing this module: https://www.wr-protect.com it is super efficient to block hack attempts and it’s a system based on artificial intelligence. available for WordPress, Joomla, Drupal, Prestashop and Magento

Featured Post

Unreal Engine vs Unity 3D ease of use

Unreal Engine vs Unity 3D Games Development: What to Choose?

When we talk about game engines, there are only two major players, Unity 3D and Unreal Engine. If you are updated about the  gaming world, you might already know that Unity 3D has 4.5 million subscriber &  a 48% market share whereas Unreal Engine is standing at 13%. However, this doesn’t say all. Both have[...] - Read More