WordPress Updates to Fix High-Severity XSS Flaw, 11 Other Vulnerabilities

Image credit: Search Engine Journal

WordPress released security update 7.0.3 on Tuesday to address 12 vulnerabilities, including a high-severity pre-authentication cross-site scripting (XSS) flaw that could lead to remote code execution.

The update, which includes fixes backported to all branches as far as version 4.7, mitigates risks associated with an 8.9 out of 10 severity XSS vulnerability located on the login screen.

The most critical vulnerability requires user interaction, often through social engineering tactics, for successful exploitation, according to cybersecurity firm Patchstack.

Oliver Sild, co-founder and CTO of Patchstack, reported that while the XSS flaw carries a high severity rating, the need for user interaction reduces the likelihood of widespread automated attacks.

In addition to the XSS issue, the 7.0.3 release addresses other significant vulnerabilities, including a Server-Side Request Forgery (SSRF) issue and a privilege escalation vulnerability affecting multisite networks.

The Open Worldwide Application Security Project (OWASP) defines XSS as a type of security vulnerability typically found in web applications, enabling attackers to inject client-side scripts into web pages viewed by other users.

Several of the vulnerabilities fixed in this release were identified by AI-powered security laboratories, including AnthropicAI, pwn_ai, and AikidoSecurity, highlighting the increasing role of artificial intelligence in discovering software flaws.

WordPress has implemented automatic updates for many installations, which is expected to help rapidly mitigate the risks posed by these newly disclosed vulnerabilities across its vast user base, according to Search Engine Journal.

Platform developers emphasized keeping installations updated to protect against potential exploits targeting these patched weaknesses.

Source: Search Engine Journal