One of the things we do to provide our customers with the best data on vulnerabilities that exist in WordPress plugins they use is to monitor changelogs for mentions of security fixes, sometimes the changes made don’t seem like they are actually fixing the vulnerability mentioned. Take the latest version of WP Database Backup, where the changelog is “Fixed Vulnerability – XSS issue”. Looking at the changes made in that version it doesn’t look like is really doing that though.

For example, in one line of code that was changed, there was already in place sanitization, which should prevent cross-site scripting (XSS): [Read more]