Trusted WordPress tutorials, when you need them most.
Beginner’s Guide to WordPress
25 Million+
Websites using our plugins
Years of WordPress experience
WordPress tutorials
by experts

WordPress 4.2.1 – Security Release Fixes Zero Day XSS Vulnerability – Update Now

Editorial Note: We earn a commission from partner links on WPBeginner. Commissions do not affect our editors' opinions or evaluations. Learn more about Editorial Process.

Just 3 days after the release of WordPress 4.2, a security researcher found a Zero day XSS Vulnerability that affects WordPress 4.2, 4.1.2, 4.1.1, 4.1.3, and 3.9.3. This allows an attacker to inject JavaScript into comments and hack your site. WordPress team responded fast and fixed the security issue in WordPress 4.2.1, and we strongly recommend that you update your sites immediately.

WordPress XSS Security

Jouko Pynnönen, a security researcher at Klikki Oy, who reported the issue described it as:

If triggered by a logged-in administrator, under default settings the attacker can leverage the vulnerability to execute arbitrary code on the server via the plugin and theme editors.

Alternatively the attacker could change the administrator’s password, create new administrator accounts, or do whatever else the currently logged-in administrator can do on the target system.

This particular vulnerability is similar to the one reported by Cedric Van Bockhaven which was patched in the WordPress 4.1.2 security release.

Unfortunately, they did not use proper security disclosure and instead posted the exploit publicly on their site. This means that those who do not upgrade their site will be in serious risks.

Update: We have learned, that they tried contacting WordPress security team but failed to get a timely response.

If you haven’t disabled automatic updates, then your site will automatically update.

Once again, we strongly advise that you update your site to WordPress 4.2.1. Make sure to backup your site before you update.

Disclosure: Our content is reader-supported. This means if you click on some of our links, then we may earn a commission. See how WPBeginner is funded, why it matters, and how you can support us. Here's our editorial process.

Editorial Staff

Editorial Staff at WPBeginner is a team of WordPress experts led by Syed Balkhi with over 16 years of experience in WordPress, Web Hosting, eCommerce, SEO, and Marketing. Started in 2009, WPBeginner is now the largest free WordPress resource site in the industry and is often referred to as the Wikipedia for WordPress.

The Ultimate WordPress Toolkit

Get FREE access to our toolkit - a collection of WordPress related products and resources that every professional should have!

Reader Interactions

16 CommentsLeave a Reply

  1. Syed Balkhi says

    Hey WPBeginner readers,
    Did you know you can win exciting prizes by commenting on WPBeginner?
    Every month, our top blog commenters will win HUGE rewards, including premium WordPress plugin licenses and cash prizes.
    You can get more details about the contest from here.
    Start sharing your thoughts below to stand a chance to win!

  2. Rajnish Tyagi says

    hi there,

    my site was 2 times in last week, i am using aws server, for database i am using RDS, but today my database was crashed it take 2 hours for recover, i am using the latest version of wprdress 4.2.2

    please advice me some good security tips


  3. Mike says

    If you have Akismet running there is a good chance that the comments will get flagged as spam so do not check your spam queue.

  4. Bernhard says

    Please take a look at where it is clearly explained how they tried contacting and received no reply SINCE NOVEMBER 2014 (Confirmed vulnerable: WordPress 4.2, 4.1.2, 4.1.1, 3.9.3.):

    “WordPress has refused all communication attempts about our ongoing security vulnerability cases since November 2014. We have tried to reach them by email, via the national authority (CERT-FI), and via HackerOne. No answer of any kind has been received since November 20, 2014. According to our knowledge, their security response team have also refused to respond to the Finnish communications regulatory authority who has tried to coordinate resolving the issues we have reported, and to staff of HackerOne, which has tried to clarify the status our open bug tickets.”

    If that is correct, disclosing the issue was the only responsible thing to do, and sites are vulnerable not because of the disclosure, but because of the failure on the part of WordPress to address this issue for almost 6 Months.

    I understand that security is a complex issue, but please get your facts straight.

  5. Bilal Bin Amar says

    but after the update, my CMS(wordpress) and my Site have became very slow, under the CMS when i click in the added a plugin this is giving error

  6. William Charles says

    I was auto updated and now it’s asking me to update my database, when I update my data base I get the following error: Catchable fatal error: Object of class WP_Error could not be converted to string in /home/doctorof/public_html/wp-admin/includes/upgrade.php on line 1459

    Any thoughts on how to fix it? Tried the usual methods (turning off plugins, default theme etc).

    • Editorial Staff says

      Please get in touch with your hosting provider. This may be happening due to a database corrupt table. We had it happened with our site List25, and our host was able to fix it right away.


    • kunwar says

      Just visit your admin login page /wp-admin and then press the update database button, this should fix the issue.

  7. pmisun says

    After the auto update applied it totally messed up our instances and we got no server responses. Investigating for 6 hours now, with no positive results. Server is fine, ip providers / isps are fine…

  8. raja babu says

    i want to know how can i secure my site , how can i stop auto update of site??? please help me

  9. Elaine Maul says

    Thank you for the alert! Although I have automatic updates set, it hadn’t got round to doing it yet for some reason, so I have actioned it myself :)
    Thank you :)

Leave A Reply

Thanks for choosing to leave a comment. Please keep in mind that all comments are moderated according to our comment policy, and your email address will NOT be published. Please Do NOT use keywords in the name field. Let's have a personal and meaningful conversation.