[!] - Wordpress - JetPack, TwentyFifteen and others

[MrGusMuller]

Any WordPress Plugin or theme that leverages the genericons package is vulnerable to a DOM-based Cross-Site Scripting (XSS) vulnerability due to an insecure file included with genericons. So far, the JetPack plugin (reported to have over 1 million active installs) and the TwentyFifteen theme (installed by default) are found to be vulnerable.

...

but if you do not have a WAF or IPS protecting your site, we highly recommend removing the example.html from inside the genericons directory.

https://blog.sucuri.net/2015/05/jetp...based-xss.html

[cybermike]

Getting annoying wordpress!

[MrBottomTooth]

So was this something fixed in the last update or something new?

[Bladewire]

Originally Posted by MrBottomTooth

So was this something fixed in the last update or something new?

I assume it's new because WP auto updated last night to 4.2.2

[MrGusMuller]

If you have the following files on ur WP you aren't safe.
wp-content/themes/twentyfifteen/genericons/example.html
wp-content/plugins/jetpack/_inc/genericons/genericons/example.html

EVEN if twentyfifteen and jetpack are disable you are compromised.

If you've updated WP core to 4.2.2, it should have removed these files for you automatically.


Peace