The developers of the WordPress content management system (CMS) announced on Thursday the availability of WordPress 4.2.3. This security and maintenance release fixes a couple of vulnerabilities, along with 20 bugs.
One of the security flaws patched with the release of WordPress 4.2.3 is a cross-site scripting (XSS) vulnerability that allows users with Contributor or Author roles to compromise a website. The issue, which affects WordPress 4.2.2 and earlier, was discovered by a member of the WordPress security team, and independently by Jouko Pynnönen of Klikki Oy, who identified several serious vulnerabilities in WordPress in the past.
WordPress’ announcement doesn’t include any technical details on this vulnerability, but according to managed WordPress hosting provider WP Engine, the issue is related to how shortcodes are used in HTML attributes.
“Essentially, this security issue could enable specially crafted shortcodes to bypass kses protection by tricking it into thinking dangerous parts are part of valid HTML,” WP Engine’s Dustin Meza explained. “This vulnerability may allow users without the unfiltered_html capability, but with publishing rights, to run JavaScript code on the front end of the website. This security update ensures all shortcodes inside attributes are evaluated and then run both through kses separately and escaped for use in attributes.”
WordPress 4.2.3 also patches a vulnerability reported by Netanel Rubin of Check Point Software Technologies. The flaw can be exploited by a user with Subscriber permissions to create a draft through the Quick Draft feature.
Users whose installations are not updated automatically are advised to manually install the latest version.
It’s worth noting that WordPress 4.2.1 and WordPress 4.2.2 were released in late April, respectively early May, to address serious XSS vulnerabilities whose details had been made public before patches became available.
*Updated to say that Jouko Pynnönen of Klikki Oy was also credited for reporting the XSS flaw
Related: WordPress Is the Most Attacked CMS