Wordpress Security Advisory

wordpress-security-advisory

As many of you know (or maybe you don’t), because WordPress is an extremely popular platform, it can be vulnerable to security issues. I like to compare it to security issues on the Windows operating system vs other operating systems. It is much more common to pick up a virus or get hacked on a computer running Windows than any other kind of computer. This is due to the fact that Windows is a much more popular, commonly used platform than OSX on a Mac, or Linux. Likewise, one of the drawbacks of using a platform as popular as WordPress to develop websites is that your website will be targeted by hackers. That being said, if you keep on top of WordPress updates and plugin updates, and you use a quality security plugin, such as Wordfence, you are usually going to be OK.

Ok, let’s talk about the latest wave of security issues you need to be aware of as of April 27, 2015. If you are reading this in the future, it is still probably going to be a valid thing to check for.

XSS Vulnerability Affecting Plugins

So what is an XSS vulnerability? An XSS vulnerability is also known as “cross-site scripting”. Without getting unnecessarily technical, this vulnerability is an input validation problem that will let a hacker inject scripting code into your browser which could, according to veracode.com, potentially:

Hijack an account.
Spread Web worms.
Access browser history and clipboard contents.
Control the browser remotely.
Scan and exploit intranet appliances and applications.

Veracode has a great video explaining cross-site scripting. You can see it here.

What can you do?

As we have mentioned in the past, the best thing to do is:

Keep your WordPress installation up to date
Keep your plugins up to date.

We have found it is extremely important to have a system in place to keep your WordPress site and plugins backed up and up to date in case it does happen to get hacked.

We use a few plugins that have greately increased our ability to keep an eye on our WordPress sites and make sure they are backed up and secure.

We use the iThemes Sync product to update all of our sites from one dashboard.

We also use iThemes Backup Buddy plugin to make scheduled backups of our WordPress sites and databases.

To keep our WordPress sites secure with regular securty scans to see if our plugins are in need of updating and to protect our sites from login hacking, we use Wordfence.

I have overly simplified what this vulnerability is and what it can do. I wanted to write this short blog post to make people aware of this latest WordPress security issue. Here are a few more links if you would like to learn more:

https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html

http://wptavern.com/xss-vulnerability-affects-more-than-a-dozen-popular-wordpress-plugins

Let us know if you need help

We would be glad to help you with making sure your site is up to date, protected and backud up. We have many years experience building and maintaining WordPress websites.

You can give us a call at: 505-379-2209 or contact us by clicking the button below.

Written By Mike Tungate

Hello! I am the Web Services Manager @ EnvisionIT Solutions. I create beautiful websites, branding and marketing systems for businesses. Let me know if you have any questions. I am an avid photographer and a lover of musical instruments.

City skyline with tall buildings during sunset with colorful sky.

| Website