Jetpack 4.0.3 just fixed a security flaw named Stored XSS. It allows a visitor to insert a shortcode containing some HTML attributes usually forbidden. The vulnerability According to Sam Hotchkiss, member of the Jetpack development team, this XSS vulnerability can be found in the shortcodes parsing method, a Jetpack’s one. A attacker could easily add some JavaScript code in your comments to hack your visitor’s […]
On May 10th 2016, All In One WP Security & Firewall patched some SQL injection detected by our team. Those flaws allow any visitor to alter DB queries. This represent a high security risk.
Recently around april, 19th 2016, iThemes Security got patched against a vulnerability discovered by our team, a lack of capability check, allowing any member with any role to perform an Administrator action.
htmltowordpress.io was vulnerable to a PHP code execution through HTML file, it’s now fixed, let’s have a look on what happened.
BJ Lazy Load is a plugin to differ the image loads, available for free on the official WordPress repository and he’s using TimThumb. On 1st september 2015, we did some research about Laly loading plugins and we finally discovered that this plugin, BJ Lazy Load v 0.7.5, was using an outdated version of TimThumb, this famous script which is still responsible of […]
This website is edited by 21(douze).
Registered office:
26, rue Montgolfier
62510 Arques - France.
SIRET
523 133 189 00010
Email
contact@secupress.me
Hosted by o2switch
222 Boulevard Gustave Flaubert
63000 Clermont-Ferrand
France