Home » Technology and Apps » Flaw in popular WordPress plug-in Jetpack puts over a million websites at risk

Flaw in popular WordPress plug-in Jetpack puts over a million websites at risk

Flaw in popular WordPress plug-in Jetpack puts over a million websites at risk

Owners of WordPress-based websites should update the Jetpack plug-in as soon as possible because of a serious flaw that could expose their users to attacks.

Jetpack is a popular plug-in that offers free website optimization, management and security features. It was developed by Automattic, the company behind WordPress.com and the WordPress open-source project, and has over 1 million active installations.

Wordpress-logo-

Researchers from Web security firm Sucuri have found a stored cross-site scripting (XSS) vulnerability that affects all Jetpack releases since 2012, starting with version 2.0.

The issue is located in the Shortcode Embeds Jetpack module which allows users to embed external videos, images, documents, tweets and other resources into their content. It can be easily exploited to inject malicious JavaScript code into comments.

Related Post: 20 Tips For A Secure WordPress Website

Since the JavaScript code is persistent, it will get executed in users’ browsers in the context of the affected website every time they view the malicious comment. This can be used to steal their authentication cookies, including the administrator’s session; to redirect visitors to exploits, or to inject search engine optimization (SEO) spam.

“The vulnerability can be easily exploited via wp-comments and we recommend everyone to update asap, if you have not done so yet,” said Sucuri researcher Marc-Alexandre Montpas in a blog post.

Sites that don’t have the Shortcode Embeds module activated are not affected, but this module provides popular functionality so many websites are likely to have it enabled.

The Jetpack developers have worked with the WordPress security team to push updates to all affected versions through the WordPress core auto-update system.Jetpack versions 4.0.3 or newer contain the fix.

In case users don’t want to upgrade to the latest version, the Jetpack developers have also released point releases for all twenty-one vulnerable branches of the Jetpack codebase: 2.0.7, 2.1.5, 2.2.8, 2.3.8, 2.4.5, 2.5.3, 2.6.4, 2.7.3, 2.8.3, 2.9.4, 3.0.4, 3.1.3, 3.2.3, 3.3.4, 3.4.4, 3.5.4, 3.6.2, 3.7.3, 3.8.3, 3.9.7, and 4.0.3.

Source: PCWorld

 

Looking for secure WordPress development services? ValueCoders provides secure WordPress development services with the following advantages. 

  1. Flexible Hiring Models
  2. Expert Teams
  3. Guaranteed SLAs

Looking to Hire Indian Developers?

Contact Us To Save Upto 50% Of Development Cost and 2x Faster Delivery

Are you ready to turn your idea into reality? Contact Us Now

More From ValueCoders Blogs:-

PHP or NodeJS: which is more secure?

From the beginning, PHP has always been there to take it to the next level. However, with the advancements in technologies, PHP apps are becoming a primary target to […] - Read More

Security Tips For Your WordPress Site [Infographic]

Security Tips For Your WordPress Site [Infographic]

WordPress is one of the most popular and powerful CMS ifor business websites and blogs. Keeping your WordPress site secure from malware is important for every business. […] - Read More

HTML5 – Important Features of Responsive Web Design

HTML5 – Important Features of Responsive Web Design

The demand for responsive websites has only increased in the recent past. With more and more smartphones, tablets and phablets getting launched every month, the demand […] - Read More

Wordpress vs Drupal vs Joomla

WordPress Vs Drupal Vs Joomla

Drupal, Joomla and WordPress are the three major Content Management Systems (CMS) preferred by most businesses. All have their own respective […] - Read More

Bulletproof Your Joomla Website

Bulletproof Your Joomla Website

According to a recent post by Royal Pingdom that compiles some intriguing Internet stats, there are roughly 634M websites in the world and around 51M are taking birth […] - Read More

10 SEO Tips for WordPress

If you are planning to launch your site or blog in WordPress, Search Engine Optimization would be one of the important things in your mind. WordPress and SEO go hand in […] - Read More

Best WordPress Development Strategies

Best WordPress Development Strategies

Website development using WordPress is both exciting and challenging. The free and open source content management system is so dynamic that you can design and develop […] - Read More

WordPress Creating Milestone with Updated iOS App Version 3.2

WordPress Creating Milestone with Updated iOS App Version 3.2

WordPress for iOS added another feather in its cap with the launch of a major update for its mobile application. The new version is nothing short of excellent as the […] - Read More

securing wordpress website

20 TIPS FOR A SECURE WORDPRESS WEBSITE

More than 70% of WordPress sites and blogs are vulnerable to attack due to their security flaws. Once you have started with your WordPress site the next major step […] - Read More

11 Mobile App Development Tips For Startups (Android & iOS)

11 Mobile App Development Tips For Startups (Android & iOS)

One of the frequent questions asked by Laravel enthusiasts and entrepreneurs all around is, can we build enterprise apps with Laravel? Is it enough mature to handle big […] - Read More

website speed optimization techniques cover page

Website Speed Optimization Techniques (Infographic)

We all want websites to load faster. The users of every website are looking for a faster, easier experience. Overall, the size of the sites are getting bigger and need […] - Read More

Laravel : An Open Source PHP Framework

Laravel is an open source PHP framework that is available in the market for free. It is designed for model-view-controller(MVC) web applications. Laravel framework has […] - Read More

9 WordPress myths to Make Your Eyes Wide Open

9 WordPress myths to Make Your Eyes Wide Open

WordPress is undoubtedly the most popular content management system in the world. But the popularity has also attracted some criticism from many experts and some ‘not […] - Read More

PHP Security: Tips To Fortify Your Website’s Security

PHP Security: Tips To Fortify Your Website’s Security

PHP or Hypertext Processor is a server-side scripting language, which is very popular among web developers, thanks to highly flexible syntax with flawlessly work in […] - Read More

Featured Post

30 Simple and New App Ideas for Startups (AI, ML, Blockchain, AR/VR)

In 2019, the demand for app ideas is increasing. More and more businesses are building apps which are lightweight, tech-savvy, fast and serves the purpose. In 2017–18, there were around $197 billion of mobile app downloads, which will jump to a stunning mark of $352 billion by 2021. The era of complex and heavy apps[...] - Read More