XSS and WPML Using Accept-Language Header
WPML contains a XSS flaw since v2.9.3
Read more
WP Rollback, a Too Permissive Plugin
In date of 26th june 2015, i doscovered the plugin WP Rollback. This plugin allow you to install an older version of one of your plugins from the official repository. Since i wanted to use this plugin, i had to check its security. Remember that if i don’t do that, then i have to remember that installing a plugin is like include […]
Add SVG Support in WordPress Medias, Yes But No!
I recently noticed an urge to add support SVG files in the WordPress media. Beautiful, very good idea, SVG is a very good format for the web and the performance for your site. The way to add the support is simple and fast, here are two bad examples: http://wpchannel.com/autoriser-envoi-fichiers-svg-wordpress/ (fr) http://wpsnipp.com/index.php/functions-php/add-support-svg-inside-wordpress-media-uploader/ We must begin by asking why […]
Vulnerability in WooCommerce 2.3.10 : Object Injection
WooCommerce 2.3.10 Yesderday, 10th, june 2015, WooCommerce has been patched from a vulnerability called “Object Injection“. We already seen this flaw in WordPress < 3.6.1 but here with a very high risk level, un WP from whom it was almost a null risk. The risk does not depend on the fault itself, but several criteria assessed and calculated […]
“My Password is Strong!” Really?
Passwords, these sesames giving access to all your data almost. When will we need a password to read your mind? Whether your mailbox, your credit card, your phone, your bank account, even your car, passwords are everywhere. The human being is intelligent, and for that, he tries to be lazy in order to save time […]