WordPress.org is a blogging platform that is owned and hosted online by Automattic. It is run on a modified version of WordPress, an open-source piece of software used by bloggers. This website provides free blog hosting for registered users and is financially supported via paid upgrades, “VIP” services and advertising.
The site opened to beta testers on August 8, 2005, and opened to the public on November 21, 2005. It was initially launched as an invitation-only service, although at one stage, accounts were also available to users of the Flock web browser. As of February 2017, over 77 million new posts and 42.7 million new comments are published monthly on the service.
features 29 fixes and enhancements
- Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting (XSS) vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored comments.
- Props to Tim Coen for disclosing an issue where validation and sanitization of a URL could lead to an open redirect.
- Props to Anshul Jain for disclosing reflected cross-site scripting during media uploads.
- Props to Zhouyuan Yang of Fortinet’s FortiGuard Labs who disclosed a vulnerability for cross-site scripting (XSS) in shortcode previews.
- Props to Ian Dunn of the Core Security Team for finding and disclosing a case where reflected cross-site scripting could be found in the dashboard.
- Props to Soroush Dalili (@irsdl) from NCC Group for disclosing an issue with URL sanitization that can lead to cross-site scripting (XSS) attacks.
- In addition to the above changes, we are also updating jQuery on older versions of WordPress. This change was added in 5.2.1 and is now being brought to older versions.