Today we published advisory CVE-2015-3429 about a DOM based cross-site scripting vulnerability in the default WordPress theme Twenty Fifteen. This WordPress theme has been included by default in WordPress since version 4.1, which was released on the 18th of December 2014.
Millions of WordPress Websites Vulnerable to DOM XSS
Since the Twenty Fifteen theme is included by default in WordPress, many WordPress users do not delete it from their installation even when they use another theme. Even though the theme is not activated, the vulnerable files can still be accessed by attackers, thus rendering such sites vulnerable to DOM XSS. When you consider that WordPress powers around 20% of the websites on the internet, there could be millions of WordPress websites vulnerable to this DOM XSS vulnerability.
How Are DOM XSS Vulnerabilities Typically exploited?
To exploit a DOM based cross-site scripting vulnerability such as this one, after identifying a vulnerable website the attacker sends an email to the website users with a link that will exploit the vulnerability and triggers a script that steals the users’ cookie. Instead of an email the attacker can also post a comment on the website itself with the malicious link.
To encourage users to click the link attackers typically send legit like emails where they advise the users to click on the link to update their profile, or to change their password etc. Even though the link is malicious, it still points to the legit website's domain hence typically users, even administrators sometimes fall for such type of tricks and click on the link.
Once a user clicks on the link and the attacker gets hold of the users’ cookie, the attacker can easily input the cookie in his browser to emulate the users’ session. Should the victim be the WordPress administrator, the attacker gains administrative privileges on the target and vulnerable website. Typically at this stage the attacker creates another user with administrator privileges to retain access to the vulnerable website and operate unnoticed. For more detailed and technical information on this vulnerability read our article DOM based cross-site scripting vulnerability.
How to Fix this WordPress DOM XSS?
WordPress just announced WordPress 4.2.2, a security and maintenance fix that addresses this and other issues. If you have automatic updates enabled most probably your WordPress websites have been updated. Alternatively, if you do not want to update your WordPress to 4.2.2, which is not recommended you can:
a) update the theme Twenty Fifteen only, or if you are not using it simply uninstall it from your WordPress website or
b) delete the vulnerable file example.html which can be found in the following WordPress directory /wp-content/themes/twentyfifteen/genericons/example.html
We are pleased to announce the appointment of Strong Crypto Innovations as 
Netsparker are happy to announce the sponsorship of 
We, Netsparker, will also have a booth where we will be exhibiting Netsparker Desktop and Netsparker Cloud, the only 
ISACA is an independent and non-profit global association that is focused on the development and adoption of industry-leading best practices for information systems, IT governance and IT security. It serves more than 140,000 members and professionals who hold ISACA certifications in more than 180 countries; most of which are security consultants, professionals, and educators.
In December 2001, the
Many have the impression that security software is difficult to use and should be left to only the highly trained experts. If you do a quick review of most of the 
Prospects frequently ask us how do 
Netsparker will be sponsoring and exhibiting
Netsparker is sponsoring and exhibiting at the Hacktrick conference in Turkey. The conference will be held between the 6th and 8th of September at the Sabanci University in Istanbul. The three day conference will include a number of seminars, courses, trainings, and CTF contests.
The Wellcome Trust Sanger Institute is a charitably funded genomic research centre and a leader in the Human Genome Project. They have been 
"The decision to use Netsparker for website and web application vulnerability scanning was due to the large library of scan settings available to choose from. This choice of scans produced easy to understand definitions of the threats that were found. Netsparker also provided solutions to the identified threats”. Steve Charlton, T4G’s Quality Assurance Specialist.
