In reviewing reports of vulnerabilities in WordPress plugins we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to level of getting their own post we now place them in a weekly post when we come across them.

Cross-Site Scripting (XSS) Vulnerability in Tagregator

Like a lot of false reports of cross-site scripting (XSS) vulnerabilities the claim that there is one in the plugin Tagregator is based on a lack of understanding that WordPress has an unfiltered_html capability that permits Administrator (and Editor) level users from doing the equivalent of XSS. [Read more]